General
-
Target
Polysy_Launcher.exe
-
Size
200.0MB
-
Sample
241211-3ysqrasqgt
-
MD5
1adfc887018848dd5f4617827d978de8
-
SHA1
e0988dff57a4323164a9a8ab65f6cfc466c12b85
-
SHA256
be61c1d0bf67dc6eab5099931f12ad2ab5a924b01273e656bf1982c159903e04
-
SHA512
5028b871595e6002787e1f04b0b0525db23e4302149327c0b9ffab2c3d8273234057dc372dee1bb12a6aab5a2b7ab6ef25c41e45bdb80e4358d418c857f05203
-
SSDEEP
768:1FbpgqnVBXVGP/IX6X/kQPwtdfzXqYcV69izh:TacBF9X6XciE5jy69iz
Static task
static1
Behavioral task
behavioral1
Sample
Polysy_Launcher.exe
Resource
win7-20241010-en
Malware Config
Extracted
meduza
193.3.19.151
-
anti_dbg
true
-
anti_vm
true
-
build_name
mrfree
-
extensions
.txt
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Targets
-
-
Target
Polysy_Launcher.exe
-
Size
200.0MB
-
MD5
1adfc887018848dd5f4617827d978de8
-
SHA1
e0988dff57a4323164a9a8ab65f6cfc466c12b85
-
SHA256
be61c1d0bf67dc6eab5099931f12ad2ab5a924b01273e656bf1982c159903e04
-
SHA512
5028b871595e6002787e1f04b0b0525db23e4302149327c0b9ffab2c3d8273234057dc372dee1bb12a6aab5a2b7ab6ef25c41e45bdb80e4358d418c857f05203
-
SSDEEP
768:1FbpgqnVBXVGP/IX6X/kQPwtdfzXqYcV69izh:TacBF9X6XciE5jy69iz
-
Meduza Stealer payload
-
Meduza family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1