Extracted

• • Target

    2024-12-14_ad6acdfef8c43ce3cb36347d05ed3853_cobalt-strike_ryuk

  • Size

    3.1MB

  • MD5

    ad6acdfef8c43ce3cb36347d05ed3853

  • SHA1

    06b115c49269694ecbf49ec3bcb1298d385c315a

  • SHA256

    007b35ee7d490e9efcb6abd1114d049f44f0d09242309ee9f877e72ec7e87ff1

  • SHA512

    87078dfa525df65dff4d6e589d0f8412a3ec2c8d6c454464a56549f7508505c1fc6f5fa1b419cc8dee0e59fbaa6e941d9886021fd822522a2aa164fc7b9a2952

  • SSDEEP

    49152:u9HsRAKr2VC09l4gSZRYqEMzYoASz38hIt04:u

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2