General

  • Target

    New_dyn.exe

  • Size

    97KB

  • Sample

    211204-eellbsdad9

  • MD5

    c2d4263b2d50f165ca6564aae098d1fa

  • SHA1

    495653e8fc20cc83f7283fd219577f58579b7b00

  • SHA256

    5ee42cc91ee256752213dbd7525816273a29257df0c52984865b7c34c51df1a2

  • SHA512

    19e370edf638ff19feb44c0856f02b145eb677a77c22ed49903644a4a3ce8b33130f3208a11c48d90ccc8b3c3f4dd6d4540e505d86cb6f619bdeef4a8589965d

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\UNLOCK_FILES_INFO.txt

Family

medusalocker

Ransom Note
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED! YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMENANTLY DESTROY YOUR FILE. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE SOLUTION TO YOUR PROBLEM. WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER. YOU CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES BACK. Contact us for price and get decryption software. We will send you information how to obtain bitcoins also. Our email: [email protected] MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. Key Identifier: msGIWYMyD5Vdt18deSff6tdhkkfJG3lMFdVWSb2ZbMw8GpHbyH+0068MqhaIAhdm4H6OhIUX7Ou++W3vWQeTOGdE2vblTiI0686gXTLcolIlDwOGYi4e4DejZ/RtE/eNx4xszzmXJBZzEbMFTA3k5KpeMB5C2HhyRnjBjF19H/ihXatUDLkYdFarKBoIU2ZgAjlIr8k4zcuRZl+ShqBvYBK8UFbmDy31Ft3prDW5BGLJc8sks6enEnuQwufrV7nsUWfDT3f0+JY1DY25E2VDkkKsZi9cUZo70SU3cldR3Ja2PUdTDyO4pjhDgTUAMXBYS/OQlcyTll5h31gYgWP/DtHm5wm3TNgrvFef3G7NvFBLgxKaqm7dcWY8Dih/R64Gu1GA6+mOQArx9CReKm5qW/5YHQYTd45ORKsGV2u9rs9cPtdeQ1JVUEgxa6f3pZQ8SmyelZqQGDbVPrc32O+sKccO/B2p5Ej6PpsGKbTwmweSH+IE/eUn/Xq0mNBxosWY6jkqCC+vY+WCBIS2jAwDb3nP6I/a+yacCdqzaQ5QpddmworP+hLk1RdUttbWAsfMmxkrP37ODNQuSci3qttWhxLV+Ka7f+YtGk3EGsBAZbvp18Mw/TfPY2LFCxJsSTyQKV/ui4pYWxnnqBP9UpOTyOrwGm7t2qYx/PNU4ZSjI9o= PC Hardware ID: A0C01CF3

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\UNLOCK_FILES_INFO.txt

Family

medusalocker

Ransom Note
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED! YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMENANTLY DESTROY YOUR FILE. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE SOLUTION TO YOUR PROBLEM. WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER. YOU CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES BACK. Contact us for price and get decryption software. We will send you information how to obtain bitcoins also. Our email: [email protected] MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. Key Identifier: oQmYx+IAC0iW+fU5qqiZaw/w526NLCzEkIK7tfe9riLPhbAbCNkXXA1t55s7b0GMaLyKOVrenkf+PzGtJ9lKrnmp4J8LqNtQMwzwYT5fr++ExmsYXRgE9uaaRXNiUz94OexMrR/MhU8SomKJVLdZDCbxutss/ejKvrDOkX7AWCW1jveUWO04KHrcBoJHR9EUJGZRsBkX3r+MCNRvSz9O3rO9UMdDLPZNqvW2g409dZojHpArLriDmgb6hNBFCxsoRdY4xReTXSTH7LbJX0SwRfNEOQfZEvjLvaDpIy/TAON7svxaj8tXx4s5T7l2tjYRP9lk0Tmf6/EnkCuRY1CTQKsDkkV5YvxLnLnUx79MB36/xhRmZTVD2X5jk/5O6ypgxw236SE9sfJaqfkjH1YykO/Lqa0tA8oDSoRRXxFXyRP0koNyxezhKdn8SRWFU5O5UZkNpC1x49t8DsPs353rkm//24dZ5ZQID+8Mvqcwo98ltaVfmz6jeRrjd8UzfTl/9EC6CRuMqo8O6I43hK5MjM1JZqojgXl1VayBQvGe/bptei6ql6Lzotx8VojN6esp1YZ4UbmwKzwTMamYEWawU2oJR2i3H0OZN8aqd+4lTBSOidhDpVokP3jUNf8GqDGab5nhQlwJ8QD9Ib3l8iEYsqnxaCQUm2g2FWtTR9OJS5g= PC Hardware ID: DA5D582B

Targets

    • Target

      New_dyn.exe

    • Size

      97KB

    • MD5

      c2d4263b2d50f165ca6564aae098d1fa

    • SHA1

      495653e8fc20cc83f7283fd219577f58579b7b00

    • SHA256

      5ee42cc91ee256752213dbd7525816273a29257df0c52984865b7c34c51df1a2

    • SHA512

      19e370edf638ff19feb44c0856f02b145eb677a77c22ed49903644a4a3ce8b33130f3208a11c48d90ccc8b3c3f4dd6d4540e505d86cb6f619bdeef4a8589965d

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

    • Deletes itself

    • Drops startup file

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks