Extracted

• • Target

    DLLs/Packaged/Resource.dll

  • Size

    189B

  • MD5

    4427aeee68321d0f4d7befa74e669f83

  • SHA1

    4670003762a1c217c9e8ea48fcc53f2871a7c341

  • SHA256

    a9661f89b8d957f4e71cbe1ba0342a39e5b50a1d80d974e2e1b349a273967f1b

  • SHA512

    9d9156aa8fdebf19363fed2edb82235642c8c20549369470e44fdc0db41324e2160968fd7dd43eecce1ce3da9c03dd05cdefc8d903a9d0394f5ca9a73f5c5fa3

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Serilog.dll

  • Size

    125KB

  • MD5

    181f3e3d0c509566283156816eb317ca

  • SHA1

    400debdd4fb9ae24719157132a87c4bfeff7fa6c

  • SHA256

    db0a4c4a21a1ba0937d1c22095c2b0702422efd4c7a41aaa577608288a2e69fc

  • SHA512

    039d5a0013d6f0e916a86baa95452d79d4524f5c83b913170daa73e1333b2d424c0d9a74193e71ede3a0866b778781c57993806baa08833d11df825626e6d667

  • SSDEEP

    3072:6obKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDt:bbKKz1UeZk/Phv8lDuPa

  Score

  1^/10
  behavioral3behavioral4

• • Target

    SevenZip.dll

  • Size

    49KB

  • MD5

    11eb138db53f5896f3cf95144d04132a

  • SHA1

    204fd914b84630366c3a656254f39a99a884d8d4

  • SHA256

    f80c92ce064a19d514cdaaf1838244f203c188462d26119df7b408291d68f8b8

  • SHA512

    da60124b8c95e6bc7d123def35e61041f567df57401737ad3fdaeef12140d2a6410eedf6cd29889f401cae4cff7b6c0bdd71507b2885e06cb39d75da42bd63d5

  • SSDEEP

    1536:Pyl9DERHUxDiJrVPpO+KeH8Ie1sGvLq4WMn:Kl9DGHUxDiJrRcIcsYV

  Score

  1^/10
  behavioral5behavioral6

• • Target

    Xeno Executor.exe

  • Size

    4.1MB

  • MD5

    36517f5bfae396a1d223e7491a3044cc

  • SHA1

    591a20349741340b21e0d3ea7d70a7df4043e925

  • SHA256

    e5d7e8537578b6c2f2ad9d842c51fcda0535c82b4e84c52537afe852687aa5f2

  • SHA512

    23dac5a4cca030209d9e35ba04bf0388aa0088d5e7ba4020978e77e1eeefe7f70be60bd8ccdfb81732523b726b225c6df48d005857f5b4424ec3df52f13b6394

  • SSDEEP

    49152:Xl4UjB0jUuB5ykrT/v+Qcr9tF3Vm2Jzd8SgN1IRA:14UjKguKA

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8