General
-
Target
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da.exe
-
Size
53KB
-
Sample
210917-hyehxaehf5
-
MD5
844bc3ea23be83905a02980a57879af2
-
SHA1
b8bab791e68200d11ec4ee6a2824f6d281287b85
-
SHA256
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da
-
SHA512
38221a55bf4f50a99bd4840cbc50f1468408e4fbf48a3510cc8a1c7147aa77f109d04f86f7053d20547df24d6652ccfb9827629f22d94a78e7fdfa0039d35b05
Static task
static1
Behavioral task
behavioral1
Sample
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da.exe
Resource
win7-en-20210916
Behavioral task
behavioral2
Sample
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da.exe
Resource
win10-en
Malware Config
Extracted
C:\Users\Public\Desktop\how_to_back_files.html
medusalocker
Targets
-
-
Target
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da.exe
-
Size
53KB
-
MD5
844bc3ea23be83905a02980a57879af2
-
SHA1
b8bab791e68200d11ec4ee6a2824f6d281287b85
-
SHA256
5086511712357c72400c4eb50cb9c84818174ec82fcda8e682aed5738d9b17da
-
SHA512
38221a55bf4f50a99bd4840cbc50f1468408e4fbf48a3510cc8a1c7147aa77f109d04f86f7053d20547df24d6652ccfb9827629f22d94a78e7fdfa0039d35b05
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-