medusalocker

General

Target

bbb4df0135a68363dce20e59c6fbbdecc2ea4e60639f27cb057ee3ee677b241c
Size

678KB
Sample

220201-sxlwpsgfel
MD5

c4cf890a24a54474ebae16d5afd3a3f7
SHA1

8f2882c2e29fcc28576eab0597512a1aaa336b7f
SHA256

bbb4df0135a68363dce20e59c6fbbdecc2ea4e60639f27cb057ee3ee677b241c
SHA512

3c72cb433c6e6ca5631635452f11e02473e1c9bf208b9dca7501bde2dc8dfe4cbb5660df43f05b21681e5493a7b1472639ced2c793f60f563335d24ec0ddc4af

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">48F56F8A184C696023ED868A2B0B10384D58687762A6ED1DAD8411A89DC49963100409C025CEC26E344C201A4FF25EABB358F39F744399EF02F7D190F4C13086<br>89608AE6B8DDFB67FDD1CAB4407997CE1E76A6AFC973201460B669186D6DB37B44FA040869B71871AF54BFC4BF54065EA54B3DA80F86F32218C262961743<br>3470715F6C485D745232DB5A69FA5180A971070725B8A63651827AFD8E34A3F23D99501E87A349BBC860BDE996E0ABCC144B80A247A33D7694CF5BB8F54A<br>C8FEDC1471A988213F846B73A59441D3841E2577F2C9C3C29FE4CAA8C1EC209D25DD565DEAB2778722DCD84673BDF9F70AF1E46E265A5D6CB0B1A6B46EFD<br>848F17A257A6B9DE1A93FA6353FD9CD2DCCDEE7B79669DDBD5C4728DB8EFDEC3538D7FF423C5DAD37E38D13AA828CF422FD2651CF1DA9C36EFC309D66FF5<br>C06C0C6780FFEC66A5B1CEAD917B10538BBB7DA2AB16CE53D79A7ECD5E846B81FA9FA93E69F211DEF829B5CECEED82031FDAD33C30C8CEB64F7E5A19E9CB<br>82F3496F1E571572CCA4E3604B3488B5622A98DAD98CCD5C1D14497BD8E0BAA73A0F4AAD695C237F62AF16A134F356E9DA550F35B9160AEAADA72153CCA3<br>A211A2CB2B78054FB6250D62843A5EF26D5B7797CF09A8B41359BDF67D774F30B582404F5953F9776C2885125FA6656A0426590CF1D1E5A9FA24DA9721B4<br>553994D8AAF243A32EF22A8F3B1A</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="http://gvlay6u4g53rxdi5.onion/5-AhLs1up4EyynZInLjLVK1fUUV2Cste3P-SxHatI7Robpp5OWdMNli8v9ZDlaqI9KS">{{URL}}</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can’t use the above link, use the email:</b><br> <a href="mailto:[email protected]">[email protected]</a> <hr><br> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="mailto:[email protected]">[email protected]</a>

Targets

- Target
  
  bbb4df0135a68363dce20e59c6fbbdecc2ea4e60639f27cb057ee3ee677b241c
- Size
  
  678KB
- MD5
  
  c4cf890a24a54474ebae16d5afd3a3f7
- SHA1
  
  8f2882c2e29fcc28576eab0597512a1aaa336b7f
- SHA256
  
  bbb4df0135a68363dce20e59c6fbbdecc2ea4e60639f27cb057ee3ee677b241c
- SHA512
  
  3c72cb433c6e6ca5631635452f11e02473e1c9bf208b9dca7501bde2dc8dfe4cbb5660df43f05b21681e5493a7b1472639ced2c793f60f563335d24ec0ddc4af
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker Payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2