Extracted

• • Target

    6e6656ae6250e35281bc76ad996849ad047f2013b633c00d49e2ff07e590a1c1.exe

  • Size

    3.2MB

  • MD5

    bca7e8cada42a299c99380fd96e5104f

  • SHA1

    7d45496f1b23412425ec5c39ee5e0177a9269441

  • SHA256

    6e6656ae6250e35281bc76ad996849ad047f2013b633c00d49e2ff07e590a1c1

  • SHA512

    e62a2c0c26fecbbf550621c7410dd141a1ef549b01446a4d3d6d2f16a5e31ee696392cbb00b382a8c32358fb018fa04dc85ad78bf7e5725333dfd7e63269920f

  • SSDEEP

    24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWusIIiDCVQ9owotOgbZr37SIes:KfrmzI7OXBGuDIiHitOgpLS

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2