Extracted

• • Target

    4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc.exe

  • Size

    2.6MB

  • MD5

    41f92168b17f6f6e3f0c2dd847b8790c

  • SHA1

    d72086c8d7cf22ee4a212a8aafbf2c1cfbb68db4

  • SHA256

    4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc

  • SHA512

    51993dd5aed96c4dc4863ad9126be8f8e651b363cde9042561fc9fa1c9f19febacc786c9dbde8c148cd6eaf28b536e3056582e5413e507f67d4981ddde8a001f

  • SSDEEP

    24576:V9L8hJZ4uB+Ch0lhSMXlnwgT59w2/rbS43qtrtgBGVb5Q:PL8hD4auX/weJBGs

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2