Overview

overview

10

Static

static

3

4a5229e015...dc.exe

windows7-x64

10

4a5229e015...dc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41f92168b17f6f6e3f0c2dd847b8790c.bin

  • Size

    1.1MB

  • Sample

    241221-bha28ayphp

  • MD5

    8a99d6d4b5fd989e406c05961df6b879

  • SHA1

    e9709d141f4fde07ca2c8b2b94f89715d25b9383

  • SHA256

    1b2892e534333384102bd41b24602fbcfab76fab1ec767ea65f8aa75e18fa59c

  • SHA512

    997a0c1b17c7a684e1fc43f31d73cd5cedd935f2a5321c7a854467c4c559d188084acf1aa587df41f788d6864473bf24b77b159399b87ee16b770cca3f882bf2

  • SSDEEP

    24576:yRpQXtCJ10FMG3xBaftDOITUNhzRppY0uGv5GEto76GTdxPf5gXFFmDpV:yRp6COFB3GtOITgzz+0nxto2GTTPfeXy

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    Student

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    3.145728e+06

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc.exe

    • Size

      2.6MB

    • MD5

      41f92168b17f6f6e3f0c2dd847b8790c

    • SHA1

      d72086c8d7cf22ee4a212a8aafbf2c1cfbb68db4

    • SHA256

      4a5229e0157022f1f1e52bc9ddef08d3495094f596ec8b861f82778f13664ddc

    • SHA512

      51993dd5aed96c4dc4863ad9126be8f8e651b363cde9042561fc9fa1c9f19febacc786c9dbde8c148cd6eaf28b536e3056582e5413e507f67d4981ddde8a001f

    • SSDEEP

      24576:V9L8hJZ4uB+Ch0lhSMXlnwgT59w2/rbS43qtrtgBGVb5Q:PL8hD4auX/weJBGs

    Score
    10/10
    meduzastealercollectiondiscoveryspyware

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks