General
-
Target
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
-
Size
669KB
-
Sample
220201-strb1shac7
-
MD5
4b5c296cf0ead00608c1b45998ad4765
-
SHA1
68a30a1fda9a3f4c978d921604e11ba9584b99e3
-
SHA256
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
-
SHA512
43cad6af322370b8f4e2af8e56fe6a42defef571afc155359a945497d3bfd2d8bee7500559e8b0100d7979b32d51b80f2c80332d451c5b2e4a91df6d70868031
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">FFA2B4B61BECD337224FEA56801230BE0401DAF91FCE6D5077263EBE32D46B5788C9DC8CD1DAD3F5064EAC74069E9B06633AC414206D6E0430E0F70C85F2CB85<br>E9ADCFF0977E65AF1B8588EAFA6C3DB8688B013BDDD971DE07BFB4698A96F3C0AB3D0F9F654154048DBF4ABB0604BAF13ED64FE536BF93E73C06C8D081E2<br>ACFABA89EB698A0ABFB5408255F4A5007D076921A8782DF7AC9D0161EFA6D027DFA27DF82D57578DCB2E81DEFD59B6354D4297F05692970E6E9D08A89694<br>77C0BBAB3227544755897F7FC1697EC4D515B2F2DCC442B7F0001F29D1A6A0EA5862F016703C5E8C1DD604DBE153B538F10AF757D0900409CA3B1AB7488D<br>77EB919D588E3F2A3E00B61FDE97335C412A3119A377947C6622D6B572A92789778DB3E8DD6A53CAE3CB7AB624DE43EE1BA593BA6CD653336A64C518FCCC<br>AD9D1F414DB9181D3D1280F0902F355DBA4FAF42EDC7624B9AA6C06955EEB742D1D21227885995A01759CB67C9315AAD7150C090116E801A434E5DC7D0D9<br>80F815E27142CC88249E03E6EAAC6A35E77218123EAA84584DDDE689513B240506BB38E864639ED3B7047212EA8EE6DC51BE045B41ACC0811319AA70B12B<br>ADE5B58B2C23354EBC4E0BCDE3385EBBBF257F8D522C63F75F4D91B471EE8E590C48E2E1CCC3AF8260BD5672A591FFED087689CEEF79F736A36E860319F4<br>1AF9723622328A7FAA545D03D781</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="[email protected]">[email protected]</a><br>
<a href="[email protected]
?
">[email protected] </a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">062D73C027305715A60C30CAB8CF60EAC85744BF522F45B4E3CC24228321B612929617FFF4B631457E866EA0BC07C4C56BAEBA0A68461B3E77343AA878BA0927<br>790F2C16CE1AB88C8AC9361D4AC1C6DBD4072DB5DE9F9D8736271731C398A1E62E1C907E04C746E566E6E31BE9900E603BA979772C973BDEC289424CF50C<br>D597E90DBEF8C6DEE561994BFD31F45EE8D432D194AA670DE71E319918F2A436A170E0729B560030144197C5ED9857306283FF01090CC2023B2E53A55620<br>10892179717A72CA3DEC3C95D42EAD528D242A2897B491A7CBF413C96AD708DB405B9EC8ACD3ED85C01C4237CED2910356838E4AC5EE730AF0DBFBD135A7<br>1F6628431D84B3CC156EF6F1D4BA9C1E4B468873F442EFC8703F3363AC13A86ABCF55FD947CDC3B0A3C53B993EC20D298B9DE3478C61FFD6891FF09E2EC5<br>C4346E792A2A0B1D3F37A4CC98EE00AC00AC0EFAFD203D0A996F4354A0514E040BA22CF8F35A0A964E4E84FCC9A697E16A7440D3B7368AB9BF5E48A2929E<br>0C1542692492DC3DEC9244DE18C6607C44B106E472FFC84ADC2BD7AECD119A3E433BD7A1FB9E97FAAB5369E806D0E6511A4A588E2C7793F789480DC92D87<br>510E790DE9650075174D376318A493F8F6DBCA7B2245A7BAFEE470C42AD1E0C4AC7963DB3D3F394103C2806DCE0888A2025BBE0A0AEEE6D37D3FC6BD594F<br>841E6F263202A493DD5A30D71437</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="[email protected]">[email protected]</a><br>
<a href="[email protected]
?
">[email protected] </a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
-
Size
669KB
-
MD5
4b5c296cf0ead00608c1b45998ad4765
-
SHA1
68a30a1fda9a3f4c978d921604e11ba9584b99e3
-
SHA256
ddca9b2f9b4c20faad500e19ba74c8d478c5be02596e9b1ff5a26ef4396bcd59
-
SHA512
43cad6af322370b8f4e2af8e56fe6a42defef571afc155359a945497d3bfd2d8bee7500559e8b0100d7979b32d51b80f2c80332d451c5b2e4a91df6d70868031
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Sets service image path in registry
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-