Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

  • Size

    1.2MB

  • Sample

    240628-mwh6jaxhnq

  • MD5

    ef95411945330db1907508d38bc373ac

  • SHA1

    7bb8d57cb26f3927bd741db598254efd72f249c4

  • SHA256

    114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

  • SHA512

    2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c

  • SSDEEP

    24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

    • Size

      1.2MB

    • MD5

      ef95411945330db1907508d38bc373ac

    • SHA1

      7bb8d57cb26f3927bd741db598254efd72f249c4

    • SHA256

      114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323

    • SHA512

      2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c

    • SSDEEP

      24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8

    Score
    10/10
    meduzastealercollectiondiscoveryspyware

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks