Overview

overview

10

Static

static

3

setup7.0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup7.0.exe

  • Size

    3.6MB

  • Sample

    241215-xr1vwsvpal

  • MD5

    d38571e4500bd3936c55ab41b7d40c4b

  • SHA1

    b7dfcd284dd985b92c4ab45e13bfc45dcf067ac5

  • SHA256

    ec711f3d9eb360eb08ef30c0b315de37a59da35bd6e332d8f19d18fc480d9a3c

  • SHA512

    324e71c33eab94097b4e0cc0b6d28d8bdbca1739282b6b1fafdbb440ba2ab69d256b4905046edd719bdf20192440d160193f983f2217ccaf4972b5617a2a592a

  • SSDEEP

    24576:wiSVYduVRYxf0fXRBvmt/cGFCTYGTnEt3lKTtHttN0jhmtksrP1yspoz9J7FbQxa:0QusxfsH8OThTM+tHtEjhFs4Uv4rqYp

Score
10/10
meduzastealer

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    6

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      setup7.0.exe

    • Size

      3.6MB

    • MD5

      d38571e4500bd3936c55ab41b7d40c4b

    • SHA1

      b7dfcd284dd985b92c4ab45e13bfc45dcf067ac5

    • SHA256

      ec711f3d9eb360eb08ef30c0b315de37a59da35bd6e332d8f19d18fc480d9a3c

    • SHA512

      324e71c33eab94097b4e0cc0b6d28d8bdbca1739282b6b1fafdbb440ba2ab69d256b4905046edd719bdf20192440d160193f983f2217ccaf4972b5617a2a592a

    • SSDEEP

      24576:wiSVYduVRYxf0fXRBvmt/cGFCTYGTnEt3lKTtHttN0jhmtksrP1yspoz9J7FbQxa:0QusxfsH8OThTM+tHtEjhFs4Uv4rqYp

    Score
    10/10
    meduzastealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks