General

  • Target

    2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber

  • Size

    5.9MB

  • Sample

    250307-zths7swwgs

  • MD5

    ae78b25357fe235d510e80fdceb66236

  • SHA1

    94f3276f301e2b58dea48f6ea7bc1c01d6213e30

  • SHA256

    03e976dfc44285e2a1e2146fbc2e0d646c23d79d2897805489554cea45ebcf53

  • SHA512

    dc9439e4108ae987b6db142191708aa20182a30d7cc7cc08beb83618088f8e5bea0d10552339abdde0c4f8785d9acd8f42541ed7660a6f8e21f072cf1711cbb5

  • SSDEEP

    98304:e35z7PcMH5vfEyTLMetCLigFmdiwBYwAzWgcdJR30vjDwHujR/zWjFvnaNolt2sX:eJPhH5+LBmAwBYwAzOdJR3hHuV/zgFvT

Malware Config

Targets

    • Target

      2025-03-07_ae78b25357fe235d510e80fdceb66236_luca-stealer_magniber

    • Size

      5.9MB

    • MD5

      ae78b25357fe235d510e80fdceb66236

    • SHA1

      94f3276f301e2b58dea48f6ea7bc1c01d6213e30

    • SHA256

      03e976dfc44285e2a1e2146fbc2e0d646c23d79d2897805489554cea45ebcf53

    • SHA512

      dc9439e4108ae987b6db142191708aa20182a30d7cc7cc08beb83618088f8e5bea0d10552339abdde0c4f8785d9acd8f42541ed7660a6f8e21f072cf1711cbb5

    • SSDEEP

      98304:e35z7PcMH5vfEyTLMetCLigFmdiwBYwAzWgcdJR30vjDwHujR/zWjFvnaNolt2sX:eJPhH5+LBmAwBYwAzOdJR3hHuV/zgFvT

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks