General

  • Target

    b14af38c4230de20c7c4fefc1e3c5fffb1562bacedfebc56a508f55182a6fe88

  • Size

    2.0MB

  • Sample

    240701-r6h1qsxcmf

  • MD5

    c65649e0712ef674ecfc447b17e9d62d

  • SHA1

    c50a7e942c0517bfbd6dab00f2008b0f93664453

  • SHA256

    b14af38c4230de20c7c4fefc1e3c5fffb1562bacedfebc56a508f55182a6fe88

  • SHA512

    c624562c5df7e734c1fdb2c9c4267adb2c810ef4665ff4ad9924e49412e435d0e71209fce4ea5dd6b09a9efa7fe549435e7549286e1e8da4a6e798f927c3d5b3

  • SSDEEP

    24576:bwZJshP4GuGwKCHyO1Fs43klhl+qdLVD5jAA+V4GuMWMDXB2IxLJ8Ch:kZJshQ+OH3u+qdpDWMMlxbNf

Malware Config

Targets

    • Target

      b14af38c4230de20c7c4fefc1e3c5fffb1562bacedfebc56a508f55182a6fe88

    • Size

      2.0MB

    • MD5

      c65649e0712ef674ecfc447b17e9d62d

    • SHA1

      c50a7e942c0517bfbd6dab00f2008b0f93664453

    • SHA256

      b14af38c4230de20c7c4fefc1e3c5fffb1562bacedfebc56a508f55182a6fe88

    • SHA512

      c624562c5df7e734c1fdb2c9c4267adb2c810ef4665ff4ad9924e49412e435d0e71209fce4ea5dd6b09a9efa7fe549435e7549286e1e8da4a6e798f927c3d5b3

    • SSDEEP

      24576:bwZJshP4GuGwKCHyO1Fs43klhl+qdLVD5jAA+V4GuMWMDXB2IxLJ8Ch:kZJshQ+OH3u+qdpDWMMlxbNf

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks