Resubmissions

14/05/2025, 09:21

250514-lbje5awwgy 10

28/04/2025, 15:06

250428-sgtllssmx2 10

21/09/2024, 10:01

240921-l2dybswfkh 10

General

  • Target

    BootStrapper.exe

  • Size

    2.0MB

  • Sample

    250514-lbje5awwgy

  • MD5

    17bc687b26192e0c310bb0fb1ed8026a

  • SHA1

    5b8f50ae707736779a2ddcd6f21408c7dfa81ff9

  • SHA256

    2a40ac0a968a450daff2a498d6115e6fb0ee3ca1a48487e0d901a2c211028e6e

  • SHA512

    e0f975f5381437f052e7b7c7d76d2a066f29cea4ba788224f8547bc1ca75d4f1b359f7474f48d2a6f98924049ac80d39a9c54fed92e80d18bbed365111109974

  • SSDEEP

    49152:QS0YwAhwj1tQGWtc5qqOxSnf+JtZZq7qhd8RsA7:4YwjWqqqOwQtZZq7qhk

Malware Config

Extracted

Family

meduza

C2

62.133.60.92

Attributes
  • build_tag

    jdy

  • extensions

  • grabber

    true

  • grabber_maximum_size

    500

  • mode

    x64

  • port

    22322

  • screenshot

    true

Targets

    • Target

      BootStrapper.exe

    • Size

      2.0MB

    • MD5

      17bc687b26192e0c310bb0fb1ed8026a

    • SHA1

      5b8f50ae707736779a2ddcd6f21408c7dfa81ff9

    • SHA256

      2a40ac0a968a450daff2a498d6115e6fb0ee3ca1a48487e0d901a2c211028e6e

    • SHA512

      e0f975f5381437f052e7b7c7d76d2a066f29cea4ba788224f8547bc1ca75d4f1b359f7474f48d2a6f98924049ac80d39a9c54fed92e80d18bbed365111109974

    • SSDEEP

      49152:QS0YwAhwj1tQGWtc5qqOxSnf+JtZZq7qhd8RsA7:4YwjWqqqOwQtZZq7qhk

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v16

Tasks