General
-
Target
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
-
Size
669KB
-
Sample
220201-stggtahac3
-
MD5
f3519df44f546606b256d13a209675b5
-
SHA1
e386497b7005b133226ecb7f786943f6e77641d2
-
SHA256
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
-
SHA512
d514809c2faaee6086713651f32d19b923275dd822d43dac4e8a1d787230342ba13c31c32080e8d5b4c0a21f456d41e75a7b07120775e305ebc17d43564c5d76
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">9F1548B4F3CB2CDC8421C93C9945CA8EA40AFE9244FEF0E3B8D75736B50A3180CC59981603E68F7846C9F39E67F1621AFFF145C0EF83CC821277AEF958AC9A91<br>D1EBA969B49874295BFE1A99BB4602EF9FB1B16F9ED01D84AC2501534A5437994AF865E67C2DAE42F81551C5CD6CEA418872E062C9351166F382EBFEDACF<br>85B5DA3C5D0EED439CE1FB0D09CBEFCEF9B9988819F161000FDE69A316AEF72A6D7247A44DBEA8E1BB6248A6AF461E52818BC18506AE52450BD2684B5AF7<br>CB43185A3B08F94A8B2DCC7A3E5A5DE4FF51E5C9916CA887EE95196D499CC25E1D62E2CEB6C1BDEEE1829F08CDE5CAD256C908B8E7997172DB2B8D175AB7<br>C4210DDD0D7965DC5C31628AD33C50772B49ED39E439D09D302C35F01107FE9B329CAF0E99929B6319CC2476A516C5379D46971487977BC7F8B6C0794918<br>E52F3504D0EBB4CCCEE97E43A6D9AA0A6B2E4E4E061FE0F2A70FCC0B6F2EC8BD94EACC4446DDD78ACE272931B6A002C80C91E9E702BFCC6306B49A1A7493<br>467FB322CAD4F2963526C17FC7B0056ED52B43FD34E8FA756790F4C8AAD9762975C4C9591CF1150CBD77AD52C3F8E1ABA6523FED38E207A90D73B3A7102E<br>94FD68DF715D538A61C2DDF465A94FA536D972D90D7DF1CEC9342737CF58D5B677EF70A92C24B2AA8785B12A24DD4F977ED337FBDB5B758B9E0F99CEC0C8<br>F2720D433CF04C48248892836513</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]
?
">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]
">[email protected]</a>
Extracted
Path
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">5A871C3A4A06D23FE3477E1D26A0617C2E3092B213AFAF9B32396C0E4C84AEB246854778E285C27780A2425BCB7A34DF11E005D58E6912960132E5CEE21E8353<br>79E35C6C62FEFECBE59F8C69EF65766B7A91C0A057DEFFCC20F3DEF6F4E12BD901E67E379628A92F1E2D594EEE7CA50FC52A6B886EEB0EE3732F3CC41635<br>D3915F28DAFFE9662A208C6AA4D1766292AE381A1DD85A9BCDA0C3F1E6AA48DFF4F162C7B33CD6E36FC9B1654D9BFA1AE2967A6E496103D075A163C6AF43<br>51C4BE73D2D905CB27523ADC406434A7D6D1AC4BF7D0EC66C4A951590B3895D898690BA149C3EC0C8F2E6C2C85F785341DE7DE8859A99111566A78EBC0F1<br>5178222E44204422FD8E61C00168EE773AC8D6A5FC6ABF6349978D1324513BB5F4633C521C14AD2527FD79074AABF417BEC353825F79E6F6CE1381A1AE03<br>40EF0DE62AF8D778A056AF229236ADB4DB20F90668D361988E36CBB4AD3D4E06DF023EE7A4688FD3C536DBB08F96A1D6C8FAA3180E66D7F1FCD01844EC18<br>5947124788F4FDA4FA8E90CD95BB0A9B5923BEA88A0B2BE107921BC9F65D4D68F4336C9811F938901F0E7212077851117D927A5D5393EB1A548CAD3047A0<br>3A53681869B7D9BCC12D262232CCDEF3EDEA7810665CE7CDD2703F877517B2515029E15CF5AB0F000946AB6DA95AC337F45034744CC1BD5E7D45B19841AB<br>8F225A068E689452D33E597A6985</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]
?
">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]
">[email protected]</a>
Targets
-
-
Target
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
-
Size
669KB
-
MD5
f3519df44f546606b256d13a209675b5
-
SHA1
e386497b7005b133226ecb7f786943f6e77641d2
-
SHA256
e2148660af56e9fde27e26ae3db205ca2d68ef1caf968e21f498fa94d8b56ef9
-
SHA512
d514809c2faaee6086713651f32d19b923275dd822d43dac4e8a1d787230342ba13c31c32080e8d5b4c0a21f456d41e75a7b07120775e305ebc17d43564c5d76
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-