api.ipify.org

key3.db

aurorastealer.cpp

702abb15d988bba6155dd440f615bbfab9f3c0ed662fc3e64ab1289a1098af98

f0c730ae57d07440a0de0889db93705c1724f8c3c628ee16a250240cc4f91858

cbc07d45dd4967571f86ae75b120b620b701da11c4ebfa9afcae3a0220527972

6d8ed1dfcb2d8a9e3c2d51fa106b70a685cbd85569ffabb5692100be75014803

f575eb5246b5c6b9044ea04610528c040c982904a5fb3dc1909ce2f0ec15c9ef

a73e95fb7ba212f74e0116551ccba73dd2ccba87d8927af29499bba9b3287ea7

89.185.85.245

77.105.147.140

79.137.203.37

185.106.94.105

https://api.ipify.org

rule MeduzaStealer {
	meta:
		author = "RussianPanda"
		description = "Detects MeduzaStealer"
		date = "6/27/2023"
	strings:
		$s1 = { 74 69 6D 65 7A 6F 6E 65 }
		$s2 = { 75 73 65 72 5F 6E 61 6D 65 }
		$s3 = { 67 70 75 }
		$s4 = { 63 75 72 72 65 6E 74 5F 70 61 74 68 28 29 }
		$s5 = { C5 FD EF }
		$s6 = { 66 0F EF }
	condition:
		all of them and filesize < 700KB
}