Resubmissions

20/02/2025, 14:22

250220-rpypvswrfr 10

20/02/2025, 14:19

250220-rms2lawnez 7

General

  • Target

    word.zip

  • Size

    17.9MB

  • Sample

    250220-rpypvswrfr

  • MD5

    75c02a4e85c4cedf9f7e8d681270711e

  • SHA1

    aa541c36d849f15e8f22a8e7026c3e25e0036a38

  • SHA256

    d6778db340fbb64924acfd30178d6756d9d0aae2a47a643fa3ecb7b610069ca3

  • SHA512

    bf012e9e642d951804a3b4f368769720e157fd4e05a5c95763870a159db758ca938e79ea7d4c29299631dc98d1884ecb2bcf60abe56583c97f1590e29d32ce1e

  • SSDEEP

    393216:O+R7WCsBuVoYQrXmMF5yrU+iwiDSz8fv0w43EMQOLwDBBoNUok4OJ5/T:Owso2xcJiwiDSCRIQOSBWNU9ZDT

Malware Config

Targets

    • Target

      microsoft-word.exe

    • Size

      18.4MB

    • MD5

      3b670e4c33321196a12577c2b23c9bb5

    • SHA1

      97d9d7349aa306eb312e587e3b79221e200c83d7

    • SHA256

      e52235618639c3b147ee1155f881105416c162df83decbba7c41a2b3199b1698

    • SHA512

      b25723f444b1b359e87eb5e5598d24e98455b0985a016124e9ff9bd51efca71cfde18be35448e1c4b808062e197220a053f4209601c4eade7f8b215bba9c4deb

    • SSDEEP

      393216:XUCgFl1pq9ZXC1n6/NdhHlRsFGi0WaiOY4M/ozxGYZX/:kC4TOX+6/RjiOYT/ozdx/

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks