General

  • Target

    Kraken Cheat.zip

  • Size

    10.6MB

  • Sample

    250307-3vrdhsyzcx

  • MD5

    97bef920a2174d847512ff2e2f665f71

  • SHA1

    fda7f80e7cf3a547dcad9fcfc670b005aaa36282

  • SHA256

    3ca47011191bf5911bd612c61507c443f57c1c70caedc749afc3b55e4c00c8dd

  • SHA512

    916267ac919893f37b36c66beb77392841feb86143f75bdf0b113356310cd58184fa697c9b52c3d38e51e6811a0b5f889518abb1b22dc6c6fa71da8fb06a2fc1

  • SSDEEP

    196608:4qOxPhpQfgq7d/fu5ldknMsc2S348zwmLJ25zq21BDqBnrrOOO2vfeHK3pDm:ryZpQJ7NDc2S3hwkJ2q4snrrOOOFHK5q

Malware Config

Extracted

Family

meduza

Botnet

444

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    444

  • extensions

    none

  • grabber_maximum_size

    1048576

  • links

    none

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      Kraken Cheat/Kraken.exe

    • Size

      3.7MB

    • MD5

      2efb1d6f632c13e3be57d710f190f8d0

    • SHA1

      19437cafa11c6ae5fa27e35de3369cf0817a7dbb

    • SHA256

      ca54bdbbd6238be2040eb965561f078e573569d8d2fa0756d02e2795276c62bf

    • SHA512

      ae3a3fa1c142c5d57f641da0941364189ffe01daac6a4739d5d84508f0461451ef4c818cc1164d9cfab3ddbc6f613f94e26046fd7d613e42a7ec858dec29b38b

    • SSDEEP

      49152:PQusxfstVERf60TI/s4U/cAjuvWjbQVLu3:gCu3

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks