Extracted

• • Target

    208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a.exe

  • Size

    2.0MB

  • MD5

    74609d22f478a3df31034c9f29892da3

  • SHA1

    d9256eaf50802e49114540f9ee7a7306173c9db8

  • SHA256

    208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a

  • SHA512

    30f3a93f68a2d4e8a8ba0cb3a90abe174860dbd1dc01f42fdd6708f46b94e1394ba0803b1e1478cbcd887e4d09ca15da1706d31fe6227b75cb06cb3b72d464cb

  • SSDEEP

    49152:kqKuOKE3tn7J8ZsN0zZQQI0qnX9eztpls0uNee:k3nX4lnuF

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2