medusalocker

General

Target

svhost.exe
Size

669KB
Sample

210918-nl3ymahcd9
MD5

5ec29d96f5fefb2d726f9e120786eaa9
SHA1

3f8d050bd4e823b1f2c681856d1ae6d9007d5861
SHA256

8ee1f51602f957fa82c7e9c0d834d28873307a0c576ab8c7cc99ca85fcf43b2e
SHA512

e21682f2bfee29cd0c0765a10463b2f57bde5996fa367ee2b8b6f7fae9bf5703aec24319ddf2e33890b352331f8fedda41d79ff04ec8a881a6469f6bdba0d5ff

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html

Family

medusalocker

Ransom Note

Your personal ID: 6E62911231724EFB640514F02BC7153B5D015DD08FEF741BC674499CB24932B5F4EB14622314007E3764B11EF82DBBC42EA41CF76AD782BB9C2197A9BB68F734 CAEE29B251BB44CC4E26002F6EF933200AA830AB8CC806986A253FB5C61C87C24E1129131D98FE649DE327D92E74D0714D354A4C40C710609F7E6EEE1060 DD1D3CE1DB4F0176BBA57E49ACD22D24F84BBC66069396AFE8308427CA552546248DF65E5971952C07DD6A4AF13C5536A1182BB16C462F0DCBA3590E26A1 B97ED67A5DB132D67CE468B50FDC5731F9A1E39CBB1E99F54CC87F07D973DB0A22264258F003B3443AC6211DE6E3CC49117A2DDD106C9E18588676E7EDC9 DE97E1221059D3418712EECC28BD810BB0F48801D849B4CFFAC6A662C08B28D3DFA1EAC880F8D3A18A6205391BC6DC17B0222CE21E67FD22EE17B507AB35 5B4B57DE9E9C1FFE24EC8E46C656536BB1D13402440ABEB55481B4AAB9EF7ECD55C70B1916D47A6DB9CC4F83276D1D57089272BB8BE9355C5D7D5FC5959B EFF50C34323BF8FCAB55D22E96CF88F3E63FE652F1215BD89B6672B26DFF18C3F6CA7B599FA68731C8D2AAFE0876E02E7A09B22AE1E6CBD7120D37CBC74B 2F849B9DD94226E71016BDCD388E18B65751BE196751EEFEEC1E693BE2B019E0D971D1315061F5676D0C8B0B8B89CE4F8D2CC770ACF035C882DD3FCB9E54 6A6F5D03DCE38C44772285E43C33 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. .onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open .onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

[email protected] [email protected]

Targets

- Target
  
  svhost.exe
- Size
  
  669KB
- MD5
  
  5ec29d96f5fefb2d726f9e120786eaa9
- SHA1
  
  3f8d050bd4e823b1f2c681856d1ae6d9007d5861
- SHA256
  
  8ee1f51602f957fa82c7e9c0d834d28873307a0c576ab8c7cc99ca85fcf43b2e
- SHA512
  
  e21682f2bfee29cd0c0765a10463b2f57bde5996fa367ee2b8b6f7fae9bf5703aec24319ddf2e33890b352331f8fedda41d79ff04ec8a881a6469f6bdba0d5ff
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker Payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2