medusalocker | 2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf

Sharing

Copy URL Twitter E-mail

General

Target
2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf
Size 678KB
Sample220201-s85syshaaq
SHA256 2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf
MD5 1949c77301a09b81cde6aaf9e73e42b5
SHA1 00a0da7e0695b67b34d238b77265db701262a149
SHA512 6560862dd2a3a04ab4944316d25c772b1136a0a6d90324256c13d9a9e702eaeae9e6c5b2b2e0e7c709a4cd32058d2ba8e6e72721f39cf67ece73aaa15dfaa2f0
SSDEEP 12288:cPJ4UhTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuuJVoM7:JeTYVQ2qZ7aSgLwuVfstRJLZYM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker Payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

File Explorer

2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf

.exe 678KB

2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf

IMPHASH f2a8a842c869f344b4d75729bc60feed
SHA256 2d9172f85666ccd84d4d4087deb491247a168c1668f0095c8b4f042d3b0ad4cf
MD5 1949c77301a09b81cde6aaf9e73e42b5
SHA1 00a0da7e0695b67b34d238b77265db701262a149
SHA512 6560862dd2a3a04ab4944316d25c772b1136a0a6d90324256c13d9a9e702eaeae9e6c5b2b2e0e7c709a4cd32058d2ba8e6e72721f39cf67ece73aaa15dfaa2f0
SSDEEP 12288:cPJ4UhTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuuJVoM7:JeTYVQ2qZ7aSgLwuVfstRJLZYM
MD5 SHA1 SHA512 SSDEEP

windows x86

MedusaLocker Payload

Minor OS version

Major OS version

Entry point

241320

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32NextW Process32FirstW CreateProcessW GetTickCount CopyFileW GetCurrentProcess WriteConsoleW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject TerminateProcess FindClose FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW FindFirstVolumeW QueryDosDeviceW GetEnvironmentVariableW GetLogicalDrives GetProcessHeap MoveFileExW SetFilePointerEx HeapAlloc CloseHandle GetLastError SetFileAttributesW GetFileAttributesW CreateFileW WriteFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileType HeapReAlloc GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID HeapFree GetFileSizeEx IsValidLocale GetTimeFormatW GetDateFormatW GetStdHandle ReadFile OpenMutexW Sleep CreateMutexW GetModuleFileNameW SetEnvironmentVariableW EncodePointer DecodePointer RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection FormatMessageW WideCharToMultiByte QueryPerformanceCounter MultiByteToWideChar FindFirstFileExW FindNextFileW GetFileAttributesExW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitProcess

advapi32

CryptExportKey RegCreateKeyW RegOpenKeyExW RegSetValueExW RegCloseKey CryptReleaseContext CryptGenKey CryptImportKey OpenProcessToken GetTokenInformation CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW OpenServiceW QueryServiceStatusEx CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey RegDeleteValueW

shell32

SHEmptyRecycleBinW

ole32

CLSIDFromString IIDFromString CoInitializeEx CoGetObject CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysStringByteLen VariantInit SysFreeString

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

IcmpSendEcho IcmpCloseHandle GetAdaptersInfo IcmpCreateFile

ws2_32

inet_addr

rstrtmgr

RmShutdown RmRegisterResources RmStartSession RmGetList RmEndSession