Overview

overview

10

Static

static

3

pablo.exe

windows7-x64

10

pablo.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pablo.exe

  • Size

    2.6MB

  • Sample

    250118-y8tctatrgp

  • MD5

    a45a9d7f9d4fc7eafd45f10eae62ad88

  • SHA1

    6955187b25889fc75d42a0a84af97c6e071eb7cb

  • SHA256

    3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c

  • SHA512

    c9858c03cb5166e12b513df7cd328a25b27bbb039cea295077f0b0cc01789c8e591ec0e63c42c56994d4f18bf8690fe3f1db55d21440af820a8b6414b14b0ab2

  • SSDEEP

    24576:V9L8hJZ4uB+Ch0lhSMXlNnx1BLuAeQcYgHHd4pcT15Q:PL8hD4au93BLuXQtgn2f

Score
10/10
meduzastealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    SEO2.0

  • extensions

    .txt; .doc; .xlsx

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Targets

    • Target

      pablo.exe

    • Size

      2.6MB

    • MD5

      a45a9d7f9d4fc7eafd45f10eae62ad88

    • SHA1

      6955187b25889fc75d42a0a84af97c6e071eb7cb

    • SHA256

      3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c

    • SHA512

      c9858c03cb5166e12b513df7cd328a25b27bbb039cea295077f0b0cc01789c8e591ec0e63c42c56994d4f18bf8690fe3f1db55d21440af820a8b6414b14b0ab2

    • SSDEEP

      24576:V9L8hJZ4uB+Ch0lhSMXlNnx1BLuAeQcYgHHd4pcT15Q:PL8hD4au93BLuXQtgn2f

    Score
    10/10
    meduzastealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks