Extracted

• • Target

    Solara.exe

  • Size

    659.5MB

  • MD5

    f2530d5dd1c7badb9bc556c4c40a9b15

  • SHA1

    d7f0bb90c6878e815bcec0b6e2dcfa0f20df75d4

  • SHA256

    75094ee4d42fc8150f0426b762c5a5c7effad945a753e369e1d611e0d3081074

  • SHA512

    0865ca79c960bbdba41280e6960e4293ae2ca0ac55bd31de9d65a8ef8bfbc813f2d867d91546fb99ce7d4d3dbff5f816bbcc0ff8700ed12422fdeafc6b3409f0

  • SSDEEP

    98304:d57plQ1rRPyQRUbhFVSDoWGbqNv2OjzfIlgrSd1D:DplMRPyQRUbhFwDp2+ZfpSd1

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1