Extracted

• • Target

    2025-02-07_903480247362183eb1a113885e351981_cobalt-strike_ryuk

  • Size

    3.1MB

  • MD5

    903480247362183eb1a113885e351981

  • SHA1

    71119623dc686007802b2da3c7073b63f26012cc

  • SHA256

    b5ae0e5a220536b0f9338a061ebd95de48956d2131af0f61d4680269524dd6ff

  • SHA512

    325d9d2ab3a8298b68c21dba4ff9e5a6fda2075fd7c8815d9736b692aa374b2a6ab7e10fe27b6067306e944c7321683bebb8dd96ea519d3bbd92705e8d919089

  • SSDEEP

    24576:Tii136ZtF+6dI4n5Nswa1XGNK4AzinID9jq5BuFrGyfPi9dhyNPZVi/2FLnyZ5Tg:/qrm9zXiw6vo+syX36R

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2