General

  • Target

    399b2859420738500eb977f816fe61e1.bin

  • Size

    1.7MB

  • Sample

    241209-bg639sxjht

  • MD5

    0fc144f6abd3cadff43aea554fe3532c

  • SHA1

    3db66e84236e547b62efeaacf0d0a5af8e835896

  • SHA256

    fb9bd09e264e23a2b8ee573e2226fc460a7af596183d2007ccaeabbdd3c60830

  • SHA512

    f708e9d0fbd954deb1a8934ded7bbfc8e2786639bff03b7d5ab97c1d380af49af1e08d774faa49bf8781e936c4bbb4f2e5141503d86f3a8b2d7cd412fd032690

  • SSDEEP

    49152:v1aP0NIkaUnZn6FVk6V7Dvg9nK701cLhoMo:v7IVUnZRmPvCKAmLhE

Malware Config

Extracted

Family

meduza

C2

5.252.155.28

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    824

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      c611fe9b5ae81cc5cce3c7f428d98e082898ee4e76c8566100ac41527e4c9a18.exe

    • Size

      4.1MB

    • MD5

      399b2859420738500eb977f816fe61e1

    • SHA1

      3136c6ce4de53ee344f51d99606bdd68b2116767

    • SHA256

      c611fe9b5ae81cc5cce3c7f428d98e082898ee4e76c8566100ac41527e4c9a18

    • SHA512

      1bfa955fc301ee63d3b5bfbcea2e9bd9d9df8ff01ed634e6b6eb01b287cac437d08af9d4e61da21d2fd3ecc3297a8cf1c2f514cb0e178b63be65e366991da086

    • SSDEEP

      49152:Xl4UjB0jUu8Xywd2qeDScrUXVIqWLskA:14UjKgufA

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks