Extracted

• • Target

    e4734d69d67cf9bae175e61edcf2449458335ae0ac592a080ee7b2e2ccb61c2aN.exe

  • Size

    3.2MB

  • MD5

    831160fa50069e68d836381d8d793010

  • SHA1

    596b3ce9c86f516f6b4e53693a33d9751e55d3ff

  • SHA256

    e4734d69d67cf9bae175e61edcf2449458335ae0ac592a080ee7b2e2ccb61c2a

  • SHA512

    c8031fc95ad21edacfa0dfecffb7df0bf590d22758e530a14e77dde0f03361aea5a18d32f888226fdbed10d18a9d4ad578ede8320e87d77f555eeabfaba8b0ee

  • SSDEEP

    24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWuQXRnEDRZ58WfR2u7XNfs9mMlkc:KfrmzI7OXBGuQXdENZ552u7dfjE

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2