Extracted

• • Target

    StakePredict.rar

  • Size

    2.2MB

  • MD5

    9318442bdd24d1837eda79c1f7f7bc2e

  • SHA1

    c3bb4d657b336ccd8a0d2cd34d993fb88b6ab7bb

  • SHA256

    cf48e7a28c8a3cf6787c5eb193bbe23c0c17fa5716c297c23316972e6c0d6b60

  • SHA512

    50e74264099db82e72e2ccd7673654a96182975fba1f84859b6dbfbac78318cbf31c352f4eeee446b12da1b2d3f56aa2d3c8d45f9de3dc3b3eca0b1e7765fa71

  • SSDEEP

    49152:jU1MLxRC0Pisl1WFn9VZAAoi2RFM/672XBGwBYDKbQFZ6HCT11:jp3WNhQ6jX8wBO8QFZN51

  Score

  10^/10

  meduzacollectiondiscoverystealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2