Extracted

• • Target

    WhatsApp Image 2024-08-25 at 19.33.05_3d55e667.jpg

  • Size

    221KB

  • MD5

    79976d94b495f6411cbf279c69773703

  • SHA1

    4280f5d6228b8450e5809b34087b05c182e0a364

  • SHA256

    ab1fbdebc66bbaf48985716fea2b4caf054e830384e931b6b25c92c3e302510c

  • SHA512

    6a786f3a40af4970360d6b13ade3177447e8a42c7562abc01073211305ecc336c9b1c3bbcbe69c8e5df4e22b6cef0e7354e1b35be34883dc6906a6b614f9adbe

  • SSDEEP

    6144:tnCIxNub72WbVl+jvkrQ7iXXOBE0vmhBmfCVj05:tnhmb72WbDyvBOXXOBE0vmhwKlI

  Score

  10^/10

  meduzadiscoverymotwphishingstealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw

  • Suspicious use of SetThreadContext

  behavioral1