General
-
Target
f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896.zip
-
Size
1.1MB
-
Sample
250302-pwkepsvpt6
-
MD5
048827f27c7d25b753d1c2ac79066505
-
SHA1
789aa360f39215c4c3d9ecb3c34e20ab46defbb2
-
SHA256
0bc6bab2870e143444b50d5b7e3fed642d23c1ba9101422bc4dcff8bcbe589e3
-
SHA512
3587e7025e62434ef9cdeac4bdaaa2e46ead487e7ad9d11c597f6598281afd0fda3c7d087e9deef6254df6b6c334c5b7832564596b948af8741bb644eb267436
-
SSDEEP
24576:e4SUzjxwMPbtg09b9Vw4pj6Ce8ngh9IEujLSTCnw+VP2mK2d:e4vWK5V7pzng4jL23+V+mNd
Static task
static1
Behavioral task
behavioral1
Sample
f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896.exe
Resource
win7-20240903-en
Malware Config
Extracted
meduza
1
66.63.187.173
-
anti_dbg
true
-
anti_vm
true
-
build_name
1
-
extensions
.txt; .doc; .xlsx
-
grabber_maximum_size
4194304
-
port
15666
-
self_destruct
false
Targets
-
-
Target
f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896.exe
-
Size
1.1MB
-
MD5
d61ac037c333f1bc288c1a96a4db7c21
-
SHA1
777228616a18b98103594276775188b5e138fa11
-
SHA256
f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896
-
SHA512
1aae796964099e22c3ebf8632ded9a451f01161ca6d837cd447524c58088ab05e0cfff6d297495e97b3b1a370b98b563937334f0306095b8c625641430288999
-
SSDEEP
24576:R06mH2AfjusEQ3MWTwGxXjbAnpiYQ7eVGKtFwVrJL/tXjuD/:RLmH2AfisEQ5XInpI74arx/tXj+/
-
Meduza Stealer payload
-
Meduza family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-