Overview

overview

10

Static

static

3

wallet-finder.exe

windows7-x64

1

wallet-finder.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wallet-finder.zip

  • Size

    2.4MB

  • Sample

    250103-y6yjravkbk

  • MD5

    7f8897095f694520792ba5d3f9a9bd0b

  • SHA1

    ebed8db7ab9af6b4b153f9a54323200023da79d2

  • SHA256

    f852c303a8940bf411ae88e4d03474de75b7de07964a287ba6491fd3cf545a22

  • SHA512

    5216a99120361eaf6b17e3268f728358390fc4ff2bdbe7adcb08df4bc9fff1680b7bc6986559db706ecbd8677bde0af1f157f5aa1933866a01e6d2b90c12d3bf

  • SSDEEP

    49152:DetRDFPYRGuY/oUTJozBqcfLi421FfVIZs7STGpuSBQ2aUPdTCx/CuRS:SvFPYPeTJeyfKseTGASBZxO/lS

Score
10/10
meduzacollectiondiscoverystealer

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    84

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      wallet-finder.exe

    • Size

      4.1MB

    • MD5

      12c13fbc1cb91f08144e44c5ed0f350c

    • SHA1

      accc1f7ea8be71ff2b5126d9c68d8b36a1be9afb

    • SHA256

      ea802b3b7bb8e2c558e14d6a946231dfa0f22e746e622296ce60babd10511f9f

    • SHA512

      c4f93dd2129ae77fd5810d623ec55f16448738bf7b4b324d4a4a5530ff4f0dbe639fb7c23d7216b96b08171f28e86852ee859b2cde3a12023b2c10555405fe91

    • SSDEEP

      49152:/xGK0l3e3uHuDgMhX32D/jzt2yd6CWw2Krd+S5rVWgpTZ:/xGK09yuFZ

    Score
    10/10
    meduzacollectiondiscoverystealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks