Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/i...

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://github.com/irantom66bombawot/solara-roblox/releases/download/Update!/solare.zip

  • Sample

    250106-rnd9ts1kfl

Score
10/10
meduzadiscoveryexecutionpersistencestealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    Work

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Targets

    • Target

      https://github.com/irantom66bombawot/solara-roblox/releases/download/Update!/solare.zip

    Score
    10/10
    meduzadiscoveryexecutionpersistencestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks