Extracted

• • Target

    JJSploit_8.13.9.exe

  • Size

    98KB

  • MD5

    fe9d7b49dab665c66f2462ac58913202

  • SHA1

    3fa3a12f014e2ca04972c6ea2cfb439662eef06f

  • SHA256

    b5860aa704760ecaa8cb40c378c35dbd0c1d8b29d4d6b5eb9b97fad1dfff27b5

  • SHA512

    bf6fe93ffdfcae97b480c975c0477f58157ac0551dd0c2db53f5452fbb5be23316bf0498350359447c13d9bcedfbaf44722af6edb6f8c4bad06780b2da956d9a

  • SSDEEP

    3072:wVtPS5z1wveHYI9zcRgPS5z1wveHYI9SG6mz:wVA6ZICR36ZIx

  Score

  10^/10

  discoverymeduzacollectionspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2