Overview

overview

10

Static

static

10

9bb3c3efac...03.exe

windows7-x64

10

9bb3c3efac...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3435ebfc26894fe8b895267ca8712b4.bin

  • Size

    796KB

  • Sample

    241202-cavmbstjfx

  • MD5

    1a66a1304be9211bbb26e20752ae4214

  • SHA1

    744cf4488de4d2b2499385cc7593f12bf25329ff

  • SHA256

    6c1fe82bd3a2e57b7f11c601ad863303cc06cfc4e3152647e493bffcb8666af0

  • SHA512

    d96aec8e17c0e4964bd8a5c896df15a0249be8db9965970c5794d6069662e1bcd00b07b6408652873548a8a74eee809094e5c66df8fb66cdd6ee70aedc499ef7

  • SSDEEP

    24576:3wPHRMzqiRCH+t5hhengyK+gq+yry5T+9wt6tn:+Gz9CH0ny/td9/N

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

62.60.217.159

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    xss

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    1.048576e+06

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      9bb3c3efac7be81d22c386057fe49041d7e7ef3da1974ecb987cc83eae8da103.exe

    • Size

      2.0MB

    • MD5

      d3435ebfc26894fe8b895267ca8712b4

    • SHA1

      60bcea02905c09e691043d05837e4942b8c4ae25

    • SHA256

      9bb3c3efac7be81d22c386057fe49041d7e7ef3da1974ecb987cc83eae8da103

    • SHA512

      8e884c0dcb76ca08c9674fb430b89e1bb9a3f999ac2c0078d2cefedfe72283d3249c5b9851064449294f8e39096f95c760d4c991238ed6338bb9409394872849

    • SSDEEP

      49152:kqKuOKE3tn7J8ZsN0zZQQI0qnX9eztpls0uNYe:k3nX4lnuT

    Score
    10/10
    meduzacollectiondiscoveryspywarestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks