General
-
Target
fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6
-
Size
678KB
-
Sample
220201-srjjdsghg7
-
MD5
c8d0b3efe09caffc7eb1223dd9125568
-
SHA1
52e4c3a528b68f9efae8f54191b2e4e088cddfb9
-
SHA256
fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6
-
SHA512
8c995b8ba882a67b582714c104a8d2315f56016412708d58e840e43a001446242d6e09831997a2845fa77db02d5f54129565e8908fc24f829bfbac3d8b9d86b3
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">B962595484ABB710F033126D1E46F6D11EA35512212A4015303042458EE2BAE65AB3A1CFECE53ABDA2418933D37BD4E3D1483AFE3CCC6D4187F5394DBF0480A3<br>74F0E0DCA04674F1F4C518B1EA83A4B9D7C020ED04A5BBD5FD78664FE758C34A6C87BB82D81E2029E319BE5A58AAD16CC201DC8875F2E1DA7BD34A715418<br>B4B9D57D2BBD58DB18E347813AE5304F6987FCE3DEDB65A8CDF0C8AA63EF189424C85CFD35693D696AA8816FECFEBFFCFBA67DDEC64C1FBD8F25DFB7F726<br>DF74CEAA46F06AC73E29400D3859F20487FA713889641125810B35A1C0DEE81166B1111BEDF3F1EE3549602053E03560516631A2D85E6ADE53578B1B8CE0<br>94A8CEB64EA6E6C55C01C0CE25F481AEAA6624D16C3391D72E4170C06A1157CF238D204A35A8C8B885613F33A45CD6C77EBD8945EBAB7B42B73C77D6D82A<br>08357AEFAC17544B0CAB61278581ECE5C3EA4D6E264DF1BF7CC376F23ABB3A2CE6BADF2DE7EBFFE7409CD332E2D447E4123DB6AF32B2943578F61501368A<br>C249F1EF1C38571535E57BCEF03EE8E3D2297C04FA4F9A2EC5D436BE83A2E33019FF2A30B498EBC19C1BD8A7E6CF9921A66E898B7C827DD688B33849089F<br>4BD6623B4297C864BCFAFCD1FC30E60D2880F01F4336D0CE1718BD38EBE8E1FE7C341A5A6A01838385B8310A9065B1ADCD6F26BFD3A16297B3D2BBC83378<br>8B5A0ABA980A7BFDF3504D0D3416</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/21-E6UQFCEuCn4KvtAh4TonRTpyHqFo6F6L-FOjrhKEytP5KZUoB7F18CAThAESIrU76</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href=" [email protected]">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">EF72DC356F4FD7BCFD9F1D90D7DD21AC9F559D770C1AC7A8FA581E099CBBD52F5D9C4CB1DEAA44F8CA26BF66DA148D5EE544F2D2B3BDF5044646FDF8F9B1D32D<br>0FE873C829D416A07B6CDCDFDE641260C820317F0A3B64D67F34059CF0E9A2FC6A173A822B4E767E9500C6B4116AD0436F41F1EA28A62049408182452743<br>E420F51F2CEA1F560A1ADDCA72F1370ACD917CC9AF1D4FEDFC8E703C6ADBE79A6B3925D75FF72A5BEB8EE67ECB10DFB0D993834B12245A2D30ECDD81B4DD<br>ED12758D5F466E00C10AEC63355ED59A50CB98C67DF245AFD201DC0166D6DB6933B8D01D34ADA3B8195B392A13A424A67AE495DB624A5F9587FC81C052A7<br>262963821A39593F28A76839BDA19BE72264C714E06FE5F9EE33BFAB46B4A42A1787E8BCBF113BA7EC694F935442C85DECFA7FD54345A706F24814B118CE<br>20130C1EABE95A1FA1B0E51F8F47390F20A5FFF3849D0E6E0BE6A6D0439589E5D6987B280C828B6BC125B3EB6EC0EE76DF8BD875CDE6076540A5D8CFB72E<br>9400C1C45D51EC20CA5AEAE0E8EAE26E9A3835401374E8D9EC6102084EB9855D713A051EAC9A4A28F3F626E6B0675EBC6B061220F68F7296573A457B086C<br>65A3B8EC4B6816ACE61A030EB2C5D7AF06212E713BF47CEC36DF11CEEAC5E2373A718EE2CB1E7255DB02727A5120A7F13AF4F37E4008E56AD5EB6388CA5A<br>79968EFA388E53F6AB5C4769AA50</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/21-E6UQFCEuCn4KvtAh4TonRTpyHqFo6F6L-SwDh02ff9viS9miaBHudc9LypZ6TF3Yd</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href=" [email protected]">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6
-
Size
678KB
-
MD5
c8d0b3efe09caffc7eb1223dd9125568
-
SHA1
52e4c3a528b68f9efae8f54191b2e4e088cddfb9
-
SHA256
fc29c372042941ac432de2e4cbb2dcdc22c8ffdb8b5281db982d345e73b9c7d6
-
SHA512
8c995b8ba882a67b582714c104a8d2315f56016412708d58e840e43a001446242d6e09831997a2845fa77db02d5f54129565e8908fc24f829bfbac3d8b9d86b3
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Sets service image path in registry
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-