Meduza Stealer

Hunt queries (Shodan, Censys, Fofa, URLScan)

Hunt query sharings are temporarily disabled.

Summary

TL; DR: An emerging Windows stealer

Type: Information stealer

Targeted Operating Systems: Windows

Interesting characteristics: N/A

Threat tag: win.meduza

Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza 

IOCs

• 77.73.131.73:80
• 79.137.194.188:80
• 103.241.72.56:80
• 92.246.136.222:80
• 94.228.162.3:80
• 141.98.83.242:80
• 94.228.168.159:80
• 94.228.162.149:80
• 185.225.200.120:80
• 193.233.255.60:80
• 91.103.253.184:80
• 85.192.63.57:80
• 77.105.146.152:80
• 77.232.142.8:80
• 89.208.106.112:80
• 147.45.40.196:80
• 5.182.86.194:80
• 5.42.73.251:80
• 89.208.103.177:80
• 45.15.159.130:80
• 147.45.40.99:80
• 79.137.205.179:80
• 2.56.109.134:80
• 92.246.136.161:80
• 79.137.207.35:80
• 94.156.65.246:80
• 5.182.87.145:80
• 147.45.75.185:80
• 175.110.115.65:80
• 147.45.42.25:80
• 109.107.181.83:80
• 45.138.16.132:80
• 45.138.74.228:80
• 198.44.171.3:80
• 79.137.202.68:80
• 77.105.147.157:80
• 5.42.73.150:80
• 185.161.248.199:80
• 89.185.85.207:80
• 217.197.107.145:80
• 46.226.166.200:80
• 144.202.23.219:80
• 79.137.207.163:80
• 85.192.40.131:80
• 95.181.173.126:80
• 91.202.233.135:80
• 109.120.184.181:80
• 109.120.177.177:80
• 109.120.178.115:80
• 109.107.181.48:80
• 217.196.98.138:80
• 37.221.93.9:80
• 77.221.148.13:80
• 147.45.69.114:80
• 109.120.176.38:80
• 79.137.197.154:80
• 45.15.158.144:80
• 193.233.232.6:80
• 79.137.202.152:80
• 109.120.177.43:80
• 45.141.215.44:80
• 5.42.101.184:80
• 5.42.107.163:80
• 5.42.101.189:80
• 5.182.87.218:80
• 91.92.250.224:80
• 79.137.195.24:80
• 89.185.85.44:80
• 77.221.156.5:80
• 79.137.197.6:80
• 91.103.253.227:80
• 77.105.147.23:80
• 109.107.181.111:80
• 79.137.207.27:80
• 154.26.130.199:80
• 31.177.108.30:80
• 89.169.52.127:80
• 91.92.249.70:80
• 91.214.78.238:80
• 147.45.71.7:80
• 94.228.166.50:80
• 89.169.52.177:80
• 91.92.255.110:80
• 89.169.53.116:80
• 91.103.252.124:80
• 89.169.54.70:80
• 5.182.87.173:80
• 79.137.205.182:80
• 46.226.167.205:80
• 94.228.168.216:80
• 172.99.189.221:80
• 79.137.207.237:80
• 5.42.107.78:80
• 77.105.146.8:80
• 109.120.176.15:80
• 77.105.146.121:80
• 5.42.99.0:80
• 38.22.104.179:80
• 212.113.100.91:80
• 5.42.106.42:80
• 79.137.203.159:80
• 85.192.63.3:80
• 104.161.36.41:80
• 46.226.166.245:80
• 91.214.78.199:80
• 62.60.226.81:80
• 157.254.223.253:80