General
-
Target
fdc208bac64cc29000dac8a0eb82c76133f3ba1ff162b01b3fb81b1751a51604
-
Size
678KB
-
Sample
220201-sq9n7aghg4
-
MD5
b66384a34452aea03b6f53e0265f54e4
-
SHA1
727ecd6e6e3135c97d1d1de85f49a96f8355996d
-
SHA256
fdc208bac64cc29000dac8a0eb82c76133f3ba1ff162b01b3fb81b1751a51604
-
SHA512
51ae29b3f183171501d35383850dff4e87a2945d1f8c24aebff7035ea24f3b2507b2d2bb4532a5b71dee66fa1093722436844e5528fd47cb9f084ffde3249761
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">FC6B3C70EC202E79A6C21733154A31DD9AF839B7DE38A5DD6659015E05A581D60A3033C244F9BA0BD885AC8E4305D3AB4D6BDEBAEB232538EC588AF0E2F32917<br>718B0CDC2BC0142875E1508E62113798A86E07C915036A9043ABF9471095FDCB2397C60968FFB258E10A4D8246AE87D9A6A96C95DB80BA32E2FC47D0A597<br>EA17229BC2500CA4BE83E994B07C4271666AFF09E91779A61AB823693CA658F6597B081A3176DD95B794F6E9072722B0F57D74478E47DB76001444697FE4<br>A8E523D4B7CCF5771ECF4AC07955805496DF8002CFB09F0A4CAC0B42A323FCA0EEE387CF5739362499B30DE7C8B02AA73047DCB6DCC3D13414FC71C0949A<br>4ECF0801F94D151D4CC4C458ED6C5EDCF6E3448825A5F3E3F2C6F7C805177900365B4DA6CB5E4D1D3E008EABC878255093F9EF6285783DF9989A815A1550<br>0E25E6EE4F8291767393BADD1E96AD6025BCBD923085A1D9225FD3BAC00DF0C267E6999BF26697121FE5C26F1E3B76B1DDD8A15D3BD737F7BDDA8AF32E1C<br>06EA7C80B65F398D4C46E1E46BE245C94BCA9BD594FEEA07A963ED23233E05B469D1C9F4C7CC08FA414AE3461AE6FC4AF7E34263158B6B498CCD98993761<br>DB9EAECAD8E583DA9B3523E997FF634F944EAF231ECC2BD31B08200C0F092B4EF37D3643E68E766872689A71A29C0350F8FBD9C4086B66866FCF322D250A<br>9AC005864ED253CCA0C1814AB179</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/21-3L69YMmXGyCo9EEXDhxUpinUQ5ACt9YB-ZDQx80I8CgeTT6gLa1pNWO2VwG6J5Osi</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Extracted
Path
\??\Z:\Boot\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">E51C2D4585B289D66C0A27EF066312614CFAC79BB41AC7DDEFD12A260E979EEF2F7B855AE78883DB8421FCE21ADEF374B6F07CC3E40165F387CF430646F199F6<br>439E22F8CC44DD3FCDE885881168EFDAEA9AD274D9ED9686176C43080BD6D80D8F63C3F6B4D874A0BDF5B74C3912F4BBFF0A5FD9C03F44A1DD0A58B40346<br>473F6ED79CAF512FBFDDA5E775F85D1578FF89780D075E66E4165BF4AF557E9FF2A51CB5E9DE6BB394BF6AE88AD8653C88CDB3C460BE19445B7A2B0E5DF6<br>D2EE4BB210F422542D71A0394A9B0F67B072A4E16CCCFBD72CC315611CA725C4A4EBD56E7772E2707A2CB8A3042ACE34C3AE6DF2F1F6E305A395EF707F78<br>EA841A6DF117182D33AC2BD710E258A6A801AFD117C0A02661E1067029351B55651A1997C0F25FDC06A80F7108674D4E07A5D32A640F6D428848FFCF5DE1<br>9F7F1945D2E9D7CC713302B284DF1E32F5EC3A80F354DFD146FC8B107DF39D27E4D9BC5DD071DD8F154E6BCDDE9C66307B678305908A9F9267F44123395E<br>FA42178C408F1F2F6B1C92CD2BC185C1FC83A1796754CBF1C8DADA36BCDDB0853D2EFA0489CBA97D647F6E058B583C7DF4A3DCC402469E636DFDB454E3CF<br>0FCB44ACD19BC3FB9CF31EEF04891A708F4E14F1EB4536C1608FD8040386F81F6F6D045E81DE5CC0AAA106782433242C190927EC2B66553F0499B5C5C57B<br>1DA06676C89DC48C478C858C1B06</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/21-3L69YMmXGyCo9EEXDhxUpinUQ5ACt9YB-W9405Phgd9JB5rLodKv7luUx3rEO4Ek8</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Targets
-
-
Target
fdc208bac64cc29000dac8a0eb82c76133f3ba1ff162b01b3fb81b1751a51604
-
Size
678KB
-
MD5
b66384a34452aea03b6f53e0265f54e4
-
SHA1
727ecd6e6e3135c97d1d1de85f49a96f8355996d
-
SHA256
fdc208bac64cc29000dac8a0eb82c76133f3ba1ff162b01b3fb81b1751a51604
-
SHA512
51ae29b3f183171501d35383850dff4e87a2945d1f8c24aebff7035ea24f3b2507b2d2bb4532a5b71dee66fa1093722436844e5528fd47cb9f084ffde3249761
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Sets service image path in registry
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-