Extracted

• • Target

    84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe

  • Size

    3.2MB

  • MD5

    2c77167cb50d52d86c89c811dcf6fa11

  • SHA1

    d8254a4d39f1effa97cfca5e211f7da8fa83a350

  • SHA256

    84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1

  • SHA512

    f2eed2831955b8b46585ac916bf2d2326a9c1c6a146a630c25ad06dfc334adcfc247461698f767585cd61c6d401e51c5e7f3b5f8f29777752c1776d409065eb7

  • SSDEEP

    24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWuQXRnEDRZ58WfR2u7XNfs9mMlkcI:KfrmzI7OXBGuQXdENZ552u7dfjEk

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2