Overview

overview

10

Static

static

10

208afccc12...1a.exe

windows7-x64

10

208afccc12...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74609d22f478a3df31034c9f29892da3.bin

  • Size

    796KB

  • Sample

    250113-bqe15symcy

  • MD5

    349a6d1f11b2feed7379b7a148ec5f9d

  • SHA1

    f0e3dd19d12767460a0163b9dca68c2cf2658d59

  • SHA256

    5f70cfce21970ef5a0e383ca17280f735840b62e9b98dda2e08a352dbd4444d6

  • SHA512

    6f61ecfd59226059f9761c64db81d9edd4620443367e9b45e7d897f185652b7d52489f172db9db175ea88785091f0a5690d7a66b2b92bc5cf67a9c7428e58702

  • SSDEEP

    24576:zC5425RK6DUs6TLFvPL93uhXohRDaXuQAusL89M:kRK6DUs6ThvZeKhEA7

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

62.60.226.62

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    @bebanrti

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    2.097152e+06

  • port

    15666

  • self_destruct

    false

Targets

    • Target

      208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a.exe

    • Size

      2.0MB

    • MD5

      74609d22f478a3df31034c9f29892da3

    • SHA1

      d9256eaf50802e49114540f9ee7a7306173c9db8

    • SHA256

      208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a

    • SHA512

      30f3a93f68a2d4e8a8ba0cb3a90abe174860dbd1dc01f42fdd6708f46b94e1394ba0803b1e1478cbcd887e4d09ca15da1706d31fe6227b75cb06cb3b72d464cb

    • SSDEEP

      49152:kqKuOKE3tn7J8ZsN0zZQQI0qnX9eztpls0uNee:k3nX4lnuF

    Score
    10/10
    meduzacollectiondiscoveryspywarestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks