Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE14 IOCs

Meduza Stealer or The Return of The Infamous Aurora Stealer

RussianPanda

Published June 28, 2023Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(1)

Capability(4)

Victim

Indicators of Compromise

Indicators of Compromise14

Type	Indicator	Confidence	Score	First Seen
SHA256	ddf3604bdfa1e5542cfee4d06a4118214a23f1a65364f44e53e0b68cbfc588ea file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	cbc07d45dd4967571f86ae75b120b620b701da11c4ebfa9afcae3a0220527972 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	add6ae21d25ffe8d312dd10ba98df778 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a73e95fb7ba212f74e0116551ccba73dd2ccba87d8927af29499bba9b3287ea7 file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://89.185.85.245 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	29cf1ba279615a9f4c31d6441dd7c93f5b8a7d95f735c0daa3cc4dbb799f66d4 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	702abb15d988bba6155dd440f615bbfab9f3c0ed662fc3e64ab1289a1098af98 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	1c70f987a0839d11826f053ae90e81a277fa154f5358303fe9a511dbe8b529f2 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	afbf62a466552392a4b2c0aa8c51bf3bde84afbe5aa84a2483dc92e906421d0a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f0c730ae57d07440a0de0889db93705c1724f8c3c628ee16a250240cc4f91858 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	91efe60eb46d284c3cfcb584d93bc5b105bf9b376bee761c504598d064b918d4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	2ad84bfff7d5257fdeb81b4b52b8e0115f26e8e0cdaa014f9e3084f518aa6149 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	6d8ed1dfcb2d8a9e3c2d51fa106b70a685cbd85569ffabb5692100be75014803 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f575eb5246b5c6b9044ea04610528c040c982904a5fb3dc1909ce2f0ec15c9ef file-hashintel-blogmalware	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph14 total IOCs

SHA256MD5URL

scroll to zoom · drag to pan · click IOC to open