meduza

Sharing

Copy URL Twitter E-mail

General

Target
RobloxInjector.zip
Size 25.6MB
Sample241201-ldvaeayqdt
SHA256 5af85811de6f6fd6a666e535d142aa0e36a1021bafe155f9af9a38b9f9f94f55
MD5 3a6d76be522a57932a41392c774f674b
SHA1 8e21726a9f8001484f1c996996a7218d851820c2
SHA512 e1295daa83920fd70eb11e6f2e409d889a770fe41e68ac527a1ae7531d56dfd3a1280c5869425711860ec59f4066678779d4422cfcc85b6bb6e4fbf53aeab6d2
SSDEEP 393216:aS3wjN96zL2TaJ5+6GPfkGQoPA6/FIjuP+VXNLR8HKh6z2jL8XVNrsbGQSar:akQ6ziTA5+DPYWA6mjuPei9z2eXcGQt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Work
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Targets

- Target
  Solara.exe
- Size 661.5MB
- SHA256 8ff929bb2e7cc8033cfa6927a7634d8c5cf6582f3be8a41bbc430b99ebbc64f5
- MD5 32afedd1343f2201b4ba1b3f647a06c0
- SHA1 09430e44c1f90e0e4cd247a7f60af767a5f0ed01
- SHA512 52551f51408660145b014b0f3e32fb61195a2e270ac6af9c4c639e5085f758db8bb27a466358895ed5772ca04269f7cb058ecb51cebc9286fa2e15dbdefada4a
- SSDEEP 98304:d57plQ1rRPyQRUbhFVSDoWGbqNv2ODzfIlgrSdJD:DplMRPyQRUbhFwDp2+5fpSdJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

meduza stealer collection discovery spyware
- Meduza
  Meduza is a crypto wallet and info stealer written in C++.
  stealer meduza
- Meduza Stealer payload
- Meduza family
  meduza
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  bin/d3dcompiler_43.dll
- Size 2.0MB
- SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
- MD5 1c9b45e87528b8bb8cfa884ea0099a85
- SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
- SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
- SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bin/libEGL.dll
- Size 90KB
- SHA256 63580999b8210315b664e7742b6d4f59e587d20b4d0826072a5ef311c6f25b74
- MD5 50c717ab7624384b2b2d8a953263beb2
- SHA1 58d82865ab86a193f8f6ff1cbf7677525f6e217d
- SHA512 8caac7982eba6380df162b62353088339754ff211847e3921dd74f239e8a980d588b36db385acbd2ba0edcaebcfb4d272eb0405672dc158e58666b6f695a02b4
- SSDEEP 1536:KGP6HhCY9bVfdiVkfynyCjUzjBUpgmsWS4dMOe9dl58Zh3Cz0b:KGPG/xViVk4yOUz26KPWHiyzy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  bin/libGLESv2.dll
- Size 3.7MB
- SHA256 99f261fa5a69dd2b3bd6192aaf72a0d9f88d769a311fac87963658a7573ec669
- MD5 dd3f55559ca3eb1a89e7d696c8c5de53
- SHA1 ce2785277d60aa366e6faf3c3318d5767a3d949e
- SHA512 bd47d44177970c08bb645f0e92011b2c9143c016d2baaf03a55f26e5e4fc157f1273fda49320815c0cbaa34b531c7fd1f28fa37d2486104d486063b138d75739
- SSDEEP 49152:oVgDuIkH0auiXZR2oWisTDLKvka5A9rC1Mw50uaj3cRhONxp7Im8TV659Zx/M70M:QgDWXv96pjkwpcTB5Vf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  bin/libcrypto-1_1-x64.dll
- Size 3.3MB
- SHA256 deb034588ef43db62809cc2c599374894bf7fef5df990da6eaaa0674fbec0301
- MD5 3390d76a13973bd46b512bf257c171c8
- SHA1 cd269f1f752c272e3868b4dd6dc65464715ae0b0
- SHA512 8d714e4859ffe4beb2c6a499b4d62cd549679411b5af2b50ec4f75e522e7af1943c4c29cc5d4266409351c596c6a0bb470e4ec0301e23425191f059752458620
- SSDEEP 49152:cVwASOC3IU6ixBGtlqREzGbOggxFSAnVJcjp15QAMa4OHjbtNPA6UsQ0H1CPwDvF:l4+0SgbhVUsIjJW6UsB1CPwDv3uFfJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  bin/natives_blob.bin
- Size 240KB
- SHA256 20210a0e530832a0267d584015eecb331c2ac0d841faf7b36feb9d326c32c113
- MD5 94855c31f6c24656a6d67ceae0b04cca
- SHA1 1d5346516d5f1f7546d4400ca3eea55022ddd9bd
- SHA512 1043759ed4b4e1df6f05724cf5132bbcf410bc5d6ffe791ad243a6c66a577965993d72908f032805bdc14ee8b69f93417535fcc8b38bfdb006de20f7c7b0d1c4
- SSDEEP 3072:kUotXVrxNpyXcsR/H/UxRjh7z5/w7JrMCOL2ZHJSSC/s9a:kUopVrxNpyXcsRf/UxRjhxw7JoCOLuI
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral11 behavioral12
- Target
  bin/reports/amd_ags_x64.dll
- Size 177KB
- SHA256 2449e8339e0f031bc4f954398f5917b8eb5a2d20c32d4688a083d5dd9f637ab8
- MD5 c69e3e05bf240d7762286833e39c9029
- SHA1 0bc12517a8ee4173867d54081a6d26527ab62672
- SHA512 655ba29b6dc96d88a188647f8b4a0dbf8dfaac2d9c33269105bc0985afb4d8bd1b8d6daa0d3cf11e6c9fd82ee174fca6d2607adf826d01da5edaa42a21266cf3
- SSDEEP 3072:ZbGOZiVbwfB/GT0yAajwsw3iTW2jl+uToE23JKjBaBW/L:ZbGOZ1BK0yAajw+W2jl+Al28L
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  bin/reports/animationsystem.dll
- Size 6.0MB
- SHA256 9697e7f265210559b0cb5aa023cd0b1cfbbb50cad06d8c38905aba012bcdb229
- MD5 0e1bf601bffc4b5e4cdd6deb75d59b83
- SHA1 8909467b21fb6e6095e7aa2944234518e5ed7bfd
- SHA512 3b87fe9fb2b8f066da6f144c2fc55f7e36b0cff2a0b88ef29a04995fd34a95b02416bb5334ab4608ee4439f71703b77eddfc10426617f3681715686558dc22d1
- SSDEEP 49152:QWyF999XhMwgz32urMXhLztNyDL6FMNDR/7PSIcKewd9XCFrvOWqOXFIgnHTbzXl:3sX9i207EC5gna2v7S7Qpcu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  bin/reports/assetpreview.dll
- Size 5.4MB
- SHA256 386b8145f1db7797d659cddda75a4cab8ebd930d2e9c9e83474b768ad5a87e2f
- MD5 92791e8fe8f475b0f10525a93afda182
- SHA1 301a963889cb181777e448f9b974eaa4effc2181
- SHA512 d089f2bbef45e33f9f2eb680a539d089fe542171979ba87956004e20595435acd18a1c23304534d2377eaf236a358801fb2a1a400dba8c662b89ae0af3045e15
- SSDEEP 98304:eLILqiln5Meagy6A7Bka2RdfoUZbzkBfd:eLILrnry6A7Bka2RdfoUZ/kBd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  bin/reports/ati_compress_wrapper.dll
- Size 736KB
- SHA256 59b8e6afa8bd163213b63bbc8b7af18e495ddebee801ebda39ef62fd559901c3
- MD5 6289cb9973840bde3258392cc07b4420
- SHA1 84aaa5491087ffb7aa5453f48bdf3a837839f770
- SHA512 8e64cdfa9f916b1b86a2e1798562c61d63bd13920e5d76a4a80d74f46991219961ca8354d359fcddfaba25b358254e632c73a4c74f61b444cad4fe6f10c6f0c1
- SSDEEP 12288:nWVwk2whmH7nU7OV/EWvpu1jvb+HE8SHs3dv/T58kr1Jmy:nEhmH7nU7OV/E4c1TMy8N8Hy
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  bin/reports/cs2.exe
- Size 2.8MB
- SHA256 96fb21e9e74f9c1b1bac42d0553ee9eba93e55bb6fd32a18165dc4c3d75ccd24
- MD5 6c4bec50e1f595caa7f308fbe1de3c4a
- SHA1 fc063651fcc015100f5107fb789a2cd2a39966ff
- SHA512 0e9ebcefc2018e8665be19d5620c60dbf0209e9007f00a5b6cb4a74f3c6fa3f8ea604b09d2484970034392dc6c88a9a45cc66d7c1de47a1e701ff2bf0df3a58f
- SSDEEP 12288:Prv+M0vksnul4PKgN6AqBCjta3CR5riFJnO+xtb5QqvcJCCFVdRTLnsJGU:TvX0Mi69SD5MJnO+xsqvcgCFVbcJGU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  bin/reports/csgo.signatures
- Size 13KB
- SHA256 4c4ffb1a2002c05cd2cd85712c801f1a0c75a9e6b7f20ca021c7bf4fe252dd70
- MD5 a6e1d199f3abef3582951a235f6b266c
- SHA1 74863b5a5a54af52f71b78ccf7e452403c8e883a
- SHA512 28709b5f5affbfa7e559ae89be5d2fc96984034c65f85d271a8f0351ada6b1c7d76fe61d5824060da659c9f7fccb04b5e063853da362e72107a88095bffe05e8
- SSDEEP 384:CnNjfguUtJ7UrYGCvbmQlBA4iqRXc5QtW8L1W4md7Oyig:eqn7UrCbzly4iqRXc5QEoWddB
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  bin/reports/d3dcompiler_47.dll
- Size 4.1MB
- SHA256 4432bbd1a390874f3f0a503d45cc48d346abc3a8c0213c289f4b615bf0ee84f3
- MD5 222d020bd33c90170a8296adc1b7036a
- SHA1 612e6f443d927330b9b8ac13cc4a2a6b959cee48
- SHA512 ad8c7ce7f6f353da5e2cf816e1a69f1ec14011612e8041e4f9bb6ebed3e0fa4e4ebc069155a0c66e23811467012c201893b9b3b7a947d089ce2c749d5e8910c6
- SSDEEP 49152:D5EfJYiVk9w6hAPqzag2At6i5K/8Ub6Lg3MEq/NHiQTtVr+5kb62QgdD6zoodr7P:l7iNPWHYE+Bnm8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  bin/reports/dbghelp.dll
- Size 1.5MB
- SHA256 13f0c74845318b52b76e6000564b1a99c37de48422b44ac74d034fa222c65a23
- MD5 a5e4b3ff51cf5b7926d9651908feb666
- SHA1 4ef5d229709e40f3f84e46c3a28341eadbd1a044
- SHA512 0615ff581b648715461349b1622fbc208042fc8c395cb2d271203b25b036f59edb0fc3470065dc15061af1be0fff48981f55bbea7f00c88906e9b470764a86fa
- SSDEEP 24576:xU5lL6v/X5lknycQFrQ8gKt/X95WqbQLZopKjMcqpzd1YWLfY:Kni/X5lknDFUCaQLq8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  bin/reports/engine2.dll
- Size 5.7MB
- SHA256 a288aa28f68225c5af0aea2dbfcb9e13eea04d41383d2ee7fdc06b9a0f8bb8f6
- MD5 002869af9a2cacb11010ba04ebad84f5
- SHA1 f3c33917301c983c0635a5f89e504fe72a325ad6
- SHA512 0831366bea7122498e40b29febe311863c146eebfe2c00cb2bbcab62d39d5e29f189290dfb3806e33b03717eb8def480959cee2e8d15cc29bcb6d28a96b7d035
- SSDEEP 98304:cDiPlCM18Qd0z1DEIQUt6vNce2rnnOmFNkETX:S+CM18Qd0zVETxFceFm7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28 behavioral29
- Target
  bin/reports/filesystem_stdio.dll
- Size 2.1MB
- SHA256 2d86739d202c4803559c19fc6f5f8b6b44a3df5181a1075f994a4c1279c8d111
- MD5 35b2ad0e8f6f73ae8808b3b92d9e176e
- SHA1 d28ebd01da8494d0054d6eafec49fe219e45932a
- SHA512 1b2520de20236cdc0e515a84ce2b093250e5c1ada61e2b2add75a58268535123ccd35c06bcef2cfa1afa716fa48cdd2cd5de4029294b6d91f06e53d9cf3c1789
- SSDEEP 49152:kOjPWZbTKuk214ScfZ8Jh2b/anK9GjXLmn/DnogdjnIU6iMLPQDW:kSqKB7nogds+bDW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30 behavioral31
- Target
  bin/reports/foreign.signatures
- Size 2KB
- SHA256 21e11e00b7ed809bdf765ad1f334fd0ba3ab2de94ccaaa358efdc6d6fcc40ad4
- MD5 3e763a5b9164fa6b1764f86374171245
- SHA1 58812342d882cc4b5cb2469606929aa413e0ca16
- SHA512 0dd84e22ad53a99f9da4495f82c8bdbd7e3ce055dcd8d32285b19a93364d97e45ef000fcec246a88234fc28f841fb782a3753dc8b7fd33a00923fea08c4ca76e
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Meduza Stealer payload

Meduza family

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Checks installed software on the system

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32