medusalocker | dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

Sharing

Copy URL Twitter E-mail

General

Target
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
Size 661KB
Sample220201-stn7nahac6
SHA256 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
MD5 19ddac9782acd73f66c5fe040e86ddee
SHA1 24ceba1e2951cde8e41939da21c6ba3030fc531d
SHA512 e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4
SSDEEP 12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker Payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

File Explorer

dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

.exe 661KB

dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

IMPHASH 7646b22cc6ac64de1e2378e6cd44d3a6
SHA256 dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
MD5 19ddac9782acd73f66c5fe040e86ddee
SHA1 24ceba1e2951cde8e41939da21c6ba3030fc531d
SHA512 e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4
SSDEEP 12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49
MD5 SHA1 SHA512 SSDEEP

windows x86

MedusaLocker Payload

Minor OS version

Major OS version

Entry point

230865

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleW GetCurrentProcess CopyFileW GetTickCount CreateProcessW Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject TerminateProcess FindClose GetEnvironmentVariableW GetLogicalDrives MoveFileW GetProcessHeap SetFilePointerEx HeapAlloc CloseHandle GetLastError CreateFileW WriteFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetFileType GetTimeZoneInformation EnumSystemLocalesW HeapFree GetFileSizeEx GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetStdHandle ReadFile OpenMutexW Sleep CreateMutexW GetModuleFileNameW SetEnvironmentVariableW EncodePointer DecodePointer RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW WideCharToMultiByte MultiByteToWideChar FindFirstFileExW FindNextFileW GetFileAttributesExW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WaitForSingleObjectEx GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitProcess

advapi32

CryptDestroyKey RegCreateKeyW RegOpenKeyExW RegSetValueExW RegCloseKey CryptReleaseContext CryptGenKey CryptImportKey OpenProcessToken GetTokenInformation CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW StartServiceW OpenServiceW QueryServiceStatusEx CryptExportKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey RegDeleteValueW

shell32

SHEmptyRecycleBinW

ole32

CLSIDFromString IIDFromString CoInitializeEx CoGetObject CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysStringByteLen VariantInit SysFreeString

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

IcmpSendEcho IcmpCloseHandle GetAdaptersInfo IcmpCreateFile

ws2_32

inet_addr

rstrtmgr

RmShutdown RmRegisterResources RmStartSession RmGetList RmEndSession