Extracted

Extracted

• • Target

    actualka-main/43134134.exe

  • Size

    3.1MB

  • MD5

    8a22ce5556ad5616fb1e6bc833e98b3c

  • SHA1

    ffd3e2ff7a4dc46b58783a60dbe80ca9706318b9

  • SHA256

    dd030f49d69a154e37e6287b0359ff7a19fd336a8352cc07dc4acb3c3641e7c7

  • SHA512

    9c37cb5939fb442684976a143a15d8633eed7e3fa9a4e3c44ca8a9d2b6420ae9a660b2c10da1921c200fd168489546c87004dcc19677de9b652d2ef855376088

  • SSDEEP

    24576:qiils10EyDGbEbXLmTVpREQl/18LphqeVX9batzh3QCzjXuBL+Yn:UG1SmTxflcWNmf

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    actualka-main/Dyfolyj.exe

  • Size

    138KB

  • MD5

    63805e5c8dc2663c4fa6f5f0c05bec84

  • SHA1

    7b26611fdf98030c9c7da442bb17bb90c5424a90

  • SHA256

    375bc635b33a9259f57fb15769fa741ede79d0e3f2a870e0047b3748879e491b

  • SHA512

    c275fc55948436dd05cf478291f85951dbcaf21e2a707c4e0022083f86f16517a7923fb2ca2bd962044ef2a183189daf574a6e5e7d8d6bdbd7ed86095a920f60

  • SSDEEP

    1536:OcxA4IFzn6/VvFmaUo8xUZAAg3WaDj7XWu0/N55Alh7bkcSjPi7ddI1VQN3kdb73:Ocx2bouad8xsAAFaW55eb5a40ZNcu

  Score

  10^/10

  phemedronecredential_accessspywarestealer

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer
  behavioral3behavioral4

• • Target

    actualka-main/jajajdva.exe

  • Size

    320KB

  • MD5

    4f0990ea72c03f3911be671cbceb7fda

  • SHA1

    d07332f930099c4af178e4c4adcdf166decdce91

  • SHA256

    b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290

  • SHA512

    903b441d433b39fb8b2d3cfd658261ad2c62d51e5171b0d1cfc37d058a27c946209b2fc1d9ca4ab3ef369753339a6c6d3845e95249d3b77a08caa2099c40e63a

  • SSDEEP

    6144:lKTuj7ot3QBAlFV7evwYkBS7asV24JU71esarL:lJjs3QBqFV7YlV674H

  Score

  10^/10

  phemedronediscoverystealercredential_access

  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Phemedrone family

    phemedrone

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral5behavioral6