General
-
Target
setup7.0.exe
-
Size
3.6MB
-
Sample
241213-dw63xsyngn
-
MD5
d38571e4500bd3936c55ab41b7d40c4b
-
SHA1
b7dfcd284dd985b92c4ab45e13bfc45dcf067ac5
-
SHA256
ec711f3d9eb360eb08ef30c0b315de37a59da35bd6e332d8f19d18fc480d9a3c
-
SHA512
324e71c33eab94097b4e0cc0b6d28d8bdbca1739282b6b1fafdbb440ba2ab69d256b4905046edd719bdf20192440d160193f983f2217ccaf4972b5617a2a592a
-
SSDEEP
24576:wiSVYduVRYxf0fXRBvmt/cGFCTYGTnEt3lKTtHttN0jhmtksrP1yspoz9J7FbQxa:0QusxfsH8OThTM+tHtEjhFs4Uv4rqYp
Static task
static1
Behavioral task
behavioral1
Sample
setup7.0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
setup7.0.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
meduza
109.107.181.162
-
anti_dbg
true
-
anti_vm
true
-
build_name
6
-
extensions
none
-
grabber_max_size
1.048576e+06
-
links
none
-
port
15666
-
self_destruct
true
Extracted
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
http://golden5a4eqranh7.onion/usXawLpW
http://goldeny4vs3nyoht.onion/usXawLpW
Extracted
metasploit
windows/single_exec
Targets
-
-
Target
setup7.0.exe
-
Size
3.6MB
-
MD5
d38571e4500bd3936c55ab41b7d40c4b
-
SHA1
b7dfcd284dd985b92c4ab45e13bfc45dcf067ac5
-
SHA256
ec711f3d9eb360eb08ef30c0b315de37a59da35bd6e332d8f19d18fc480d9a3c
-
SHA512
324e71c33eab94097b4e0cc0b6d28d8bdbca1739282b6b1fafdbb440ba2ab69d256b4905046edd719bdf20192440d160193f983f2217ccaf4972b5617a2a592a
-
SSDEEP
24576:wiSVYduVRYxf0fXRBvmt/cGFCTYGTnEt3lKTtHttN0jhmtksrP1yspoz9J7FbQxa:0QusxfsH8OThTM+tHtEjhFs4Uv4rqYp
-
Meduza Stealer payload
-
Meduza family
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Seon
The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
-
Seon family
-
Renames multiple (114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
System Binary Proxy Execution: Verclsid
Adversaries may abuse Verclsid to proxy execution of malicious code.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Pre-OS Boot
1Bootkit
1System Binary Proxy Execution
1Verclsid
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1