Meduza Stealer

Gather Victim Network Information - T1590.005 7 out of the 17 malware families analyzed by STRT were observed collecting network-related information, such as the public IP address, geographic location, and other metadata, by querying external IP-lookup web services.

The Meduza Stealer is an infostealer malware that targets Windows machines and focuses on stealing comprehensive data including login credentials, screenshots, browsing history, bookmarks, crypto wallets, password managers, installed games, and 2FA extensions.

Researchers have also observed Meduza Stealer infections in Poland and inside Russia itself — including one 2023 campaign that used phishing emails impersonating an industrial automation company.

Meduza Stealer typically spreads through phishing campaigns, malicious email attachments, and trojanized software downloads.

Annotations ID Technique Tactic T1059.005 Visual Basic Execution

Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities, potentially exploiting unpatched software vulnerabilities.

Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications.

Analysts have identified Meduza Stealer leveraging advanced evasion techniques, including dynamic obfuscation, anti-analysis methods, and the use of polymorphic code to bypass detection by traditional antivirus systems.

Executables Or Script Creation In Temp Path ... T1036

Its operation involves sophisticated checks, such as geolocation and server connectivity, before proceeding with data theft.

Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications.

Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities...

Login Credentials: Passwords and session tokens from over 100 browsers and 27 password managers.

Особенную ценность для злоумышленников представляют собой так называемые сессионные файлы cookie... кража таких файлов позволяет злоумышленнику использовать уже подтвержденную сессию без ввода логина и пароля от лица жертвы.

The Meduza Stealer is an infostealer malware that targets Windows machines and focuses on stealing comprehensive data including login credentials, screenshots, browsing history, bookmarks, crypto wallets, password managers, installed games, and 2FA extensions.

Credentials from Web Browsers - T1555.003 11 of these malware families also commonly target and decrypt sensitive credentials stored in browser databases.

The following analytic detects an access request on the uninstall registry key... adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks.

Its operation involves sophisticated checks, such as geolocation and server connectivity, before proceeding with data theft.

By observing the HTML of the page we can note specific unique elements that will help us on pivoting, such as the HTTP Title and the Favicon.

The Meduza Stealer is an infostealer malware that targets Windows machines and focuses on stealing comprehensive data including login credentials, screenshots, browsing history, bookmarks, crypto wallets, password managers, installed games, and 2FA extensions.

Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities...

The Meduza Stealer is an infostealer malware that targets Windows machines and focuses on stealing comprehensive data including login credentials, screenshots, browsing history, bookmarks, crypto wallets, password managers, installed games, and 2FA extensions.

Once executed, it infiltrates systems silently, harvesting data from web browsers, password managers, and clipboard activities.

MITRE ATT&CK Techniques ID Technique Tactic T1071.001 Web Protocols Command And Control

Lumma ... continues to pose a significant threat, actively exfiltrating data from individuals, organizations, and governments.