Extracted

• • Target

    25e277e1b7eeec58d0b02fe55bc37c574497faedc23e2a0a05139b3a3ab481ff

  • Size

    4.1MB

  • MD5

    074c59a677f28681f09b088b5eff7b9b

  • SHA1

    b49e41a65125eade7f90831e4eae74afe30167b7

  • SHA256

    25e277e1b7eeec58d0b02fe55bc37c574497faedc23e2a0a05139b3a3ab481ff

  • SHA512

    2f77955b930fbbefb6465e3f9a58f0c82b5f6afdefc5329416dfe5dfa2e979a3461bec977bc492b9ff85d53a42cf52b6771b9988f50455211a238cc331664abf

  • SSDEEP

    49152:qxGK0l3e3udzDRxACQG2zuPLlPx6rA3EYMHGul7irGxdecVUovWH8beZ:qxGK09yuJZ

  Score

  10^/10

  meduzacollectiondiscoverystealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2