meduza

General

Target

Setup7.0.zip
Size

3.0MB
Sample

241208-waeqnavram
MD5

71f6e7367b5f6d7cc43e4548b3af4183
SHA1

eb9afb0a5c0db357dd7ee3db18a8043761cd9353
SHA256

c9b1182e88be182dd82ac6dae59c71375f92f139f897f76b20d9dd2f1c397984
SHA512

c767a208931756e532917c714fd2c57d463011681434cfa3c08b302dd425c1d172d1c376494db8775bca2a900ee452e6bb150423daf4a6cc8abee2a05834a05a
SSDEEP

98304:KJu0vKdiLunW4uzu/jOVg/OJLEGaAM8cLyeG:eKdiLuWTzoCVgmJLEGfCLyeG

Score

10^/10

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes

anti_dbg
true
anti_vm
true
build_name
6
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Targets

- Target
  
  setup7.0/PhysxExt.dll
- Size
  
  2.9MB
- MD5
  
  6ff985653d41e8d60bb1293f01729adf
- SHA1
  
  1ae3086a16a91ea45c06d34071d8b3b87e058804
- SHA256
  
  224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
- SHA512
  
  fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
- SSDEEP
  
  24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  
  setup7.0/setup7.0.exe
- Size
  
  3.6MB
- MD5
  
  2bf989dd4c96ea131ad90ee8b2878edc
- SHA1
  
  aecf13918a9554a556ac065ee66701197a79fbad
- SHA256
  
  74346f2db53d871e2133fc15ddd99ffa5f3226f810e8fcd2e22cc84151c1874f
- SHA512
  
  6e78d8cf2061c542de844cb6a22153a9531f3bb1ad4154e41fd08e9614924f2e83dc64f366c249da47e14e1430b9cfdd15944f483e6143fc8f86ba38036d12b9
- SSDEEP
  
  49152:0QusxfsDxADLssSpX9Z3QGrJl7hhqUxFRp:5Qp
Score

10^/10

meduza collection discovery stealer
- Meduza
  Meduza is a crypto wallet and info stealer written in C++.
  stealer meduza
- Meduza Stealer payload
- Meduza family
  meduza
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral3 behavioral4