Extracted

• • Target

    2025-01-05_52dcf0012115d64a8fa966e1e4add483_cobalt-strike_ryuk

  • Size

    3.1MB

  • MD5

    52dcf0012115d64a8fa966e1e4add483

  • SHA1

    74492e90481ac88abf0e6c0bef6ec0d3e416402e

  • SHA256

    5e517727aa73b8067f0e049463b92054a07b93d6ae0cf6e3778a4ca9cab1b00c

  • SHA512

    8e54eee738428e849d53f9f9f47c478252b6c931e92849bc3e715a2ab616378203cf5c80b5c9dad259bf01f857dfd84dc95512b06b6d049fdc291c9f6773d149

  • SSDEEP

    24576:qiiSPHILlu9hrwMGoq9Jrg5Mx+eviCV4trGol0Qxqu4/5odqYjGNPmwK9brMx/:UGHIMwMKZWVHH0TsYyRg

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2