General
-
Target
124c65d01c6ba01dead43e246ae4c300d7345c8f46ae71ebf101bef5510f35aa
-
Size
667KB
-
Sample
220201-tasleahadm
-
MD5
dbedb905796795de32272ea95c45a36a
-
SHA1
76354f7b2a20d76f82343e0d01c8710600d01483
-
SHA256
124c65d01c6ba01dead43e246ae4c300d7345c8f46ae71ebf101bef5510f35aa
-
SHA512
871def3ab6253a2dfae41b5dc6bf19461bca16e234ff94165e7e25aeee79563c0a074304f0627104f76871961dd7c421dd8fa277f821cf6dfa150d61a4105b4e
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section {
display: block; }
body {
font-family: Tahoma, Arial;
background: #717798; }
.all {
max-width: 1170px;
margin: auto;
background: #000;
min-height: 100px;
border-radius: 10px; }
.tl {
text-align: center;
color: #e03930;
font-family: Tahoma;
font-size: 28px;
font-weight: 700;
position: relative;
height: 60px;
line-height: 60px;
}
.close {
padding: 15px;
width: 36px;
height: 36px;
position: absolute;
right: 15px;
top:0;
}
.bg {
background: #252a42;
text-align: center;
color: #ffffff;
padding: 25px 15px;
font-size: 18px;
font-weight: 400;
line-height: 20px; }
.bg span {
color: #f25252; }
.bg a {
color: #9676fd;
font-size: 20px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.bg c {
color: #f25252;
font-weight: 500;
font-size: 20px;
line-height: 35px;}
.footer {
padding: 15px 0;}
.tl2 {
text-align: center;
color: #e03930;
font-size: 25px;
font-weight: 500;
line-height: 32px;
text-decoration: underline;
padding-bottom: 15px; }
.text {
min-height: 192px;
color: #ffffff;
font-size: 16px;
font-weight: 500;
line-height: 24px; }
.text div {
padding-right: 50px;
padding-left: 50px; }
@media (max-width: 767px) {
.tl {
height: auto;
padding-right: 50px;
line-height: 1.5;
}
.text div {
padding: 0 15px; }
.footer {
background: none; } }
</style>
</head>
<body>
<div class="all">
<div class="container">
<div class="tl">All your data are encrypted!
<div class="close"></div></div>
<div class="bg">
<c>What happened?</c> <br>
Your files are encrypted, and currently unavailable. <br>
You can check it: all files on you computer has new expansion.<br>
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. <br>
Otherwise, you never cant return your data.<br>
<br>
<c>For purchasing a decryptor contact us by email: </c><br>
<a href="mailto:[email protected]">[email protected]</a><br>
If you will get no answer within 24 hours contact us by our alternate emails: <br>
<a href="mailto:[email protected]">[email protected]</a> <br>
<br>
<c>What guarantees?</c> <br>
Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us.<br>
To verify the possibility of the recovery of your files we can decrypted 1 file for free. <br>
Attach 1 file to the letter (no more than 10Mb). Indicate your <b>personal ID</b> on the letter:<br>
<span style="width:800px; word-wrap:break-word; display:inline-block; color: #ffffff; font-size: 10px;">D42A96F0D11BADED02BB3A58E52D52FC16F048E39E96FE06C35184B1A8E900D04FE9029CE13004338109A5513D8A27549DD0C3C25271FF1C89C05CD9E0B83916<br>122CD8ECE50980DFE3DD6E0F3B94D444DB5532257580AD62F46470CCDF5E28BCBEAF186CFD001B5285C7DBFAB1D5AA338A346CCE15D24E0F0E059BB01D7F<br>2E8B0027E0BF17324CF3BADD817B2E833A612067D4D67FE171795ABD1AC130F8A5843B9AFD09FDE316BD77F31DC360DB9C53FBFFF6F54E92B7BE7D1D3DEC<br>0E892ABE4E230B9B02F5F7FE274A728C2584DB1ECC60F6EC9D10CBC074F00CC7B45450A0F5870A9D430EAEB0CD175A9CC870C7E75315F5F571C339238BE9<br>2897E83D863FB166B97077AAF64BA991A72A62167E5D7263CC2DCE373DE99DF2FFDC119839344AE13380FA4C5F84612FEB368411305DC0196EEDBCB04690<br>C9B08239DE381B202FFEFBCAA6257857BAD52D5E09A54683B9C3D8BD8198CE3143CB7ADE397F85E8395E0D570DED866D9074F870C7E6D88578721147204F<br>729569775F8C42D306C5937F1F9A308C0C4033F1AC5D70438BC5A4A9269C08EF3B4B2F064D398CBE04A1B96AA8BFD8E4A340B76CEC0A2474B688085ECBDA<br>444D5A8054F629BE2CD4B000F7F6E059007B0D9AAB84F49F80ECA21E1AF63727EABA83344BF3FA1F52DFF0BE45A8B4B42F60DC8FDCC8519098575F58472A<br>94060719DDDA9E2B2DC9F1E70225</span>
<br>
</div>
<div class="footer">
<div class="tl2">
Attention!
</div>
<div class="bg2">
<div class="text">
<div>
- Attempts of change files by yourself will result in a loose of data. <br>
- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.<br>
- Use any third party software for restoring your data or antivirus solutions will result in a loose of data. <br>
- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.<br>
- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
Extracted
Path
\??\Z:\Boot\Recovery_Instructions.html
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section {
display: block; }
body {
font-family: Tahoma, Arial;
background: #717798; }
.all {
max-width: 1170px;
margin: auto;
background: #000;
min-height: 100px;
border-radius: 10px; }
.tl {
text-align: center;
color: #e03930;
font-family: Tahoma;
font-size: 28px;
font-weight: 700;
position: relative;
height: 60px;
line-height: 60px;
}
.close {
padding: 15px;
width: 36px;
height: 36px;
position: absolute;
right: 15px;
top:0;
}
.bg {
background: #252a42;
text-align: center;
color: #ffffff;
padding: 25px 15px;
font-size: 18px;
font-weight: 400;
line-height: 20px; }
.bg span {
color: #f25252; }
.bg a {
color: #9676fd;
font-size: 20px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.bg c {
color: #f25252;
font-weight: 500;
font-size: 20px;
line-height: 35px;}
.footer {
padding: 15px 0;}
.tl2 {
text-align: center;
color: #e03930;
font-size: 25px;
font-weight: 500;
line-height: 32px;
text-decoration: underline;
padding-bottom: 15px; }
.text {
min-height: 192px;
color: #ffffff;
font-size: 16px;
font-weight: 500;
line-height: 24px; }
.text div {
padding-right: 50px;
padding-left: 50px; }
@media (max-width: 767px) {
.tl {
height: auto;
padding-right: 50px;
line-height: 1.5;
}
.text div {
padding: 0 15px; }
.footer {
background: none; } }
</style>
</head>
<body>
<div class="all">
<div class="container">
<div class="tl">All your data are encrypted!
<div class="close"></div></div>
<div class="bg">
<c>What happened?</c> <br>
Your files are encrypted, and currently unavailable. <br>
You can check it: all files on you computer has new expansion.<br>
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. <br>
Otherwise, you never cant return your data.<br>
<br>
<c>For purchasing a decryptor contact us by email: </c><br>
<a href="mailto:[email protected]">[email protected]</a><br>
If you will get no answer within 24 hours contact us by our alternate emails: <br>
<a href="mailto:[email protected]">[email protected]</a> <br>
<br>
<c>What guarantees?</c> <br>
Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us.<br>
To verify the possibility of the recovery of your files we can decrypted 1 file for free. <br>
Attach 1 file to the letter (no more than 10Mb). Indicate your <b>personal ID</b> on the letter:<br>
<span style="width:800px; word-wrap:break-word; display:inline-block; color: #ffffff; font-size: 10px;">2A39168ED775D05C1E97AF1D3252F7E40CD53D8C5BC77B7C018CC74B0D99BD2A218399360B878611EA941EC724BACB863F50AD35609F313E2790DF80C994C8A0<br>BDA23B1575E6ED1D52F6F10CE8DDED751ED218FA05BB3A991F553F1227E179E8506BA19932D52FD03421B750B2FD1EA9292FDA432B6A9458CB9F7B1C2F70<br>22CC4DC070308ED779F7872064CDDA2D17C5380E32331D723704B4DFE090805F34B69E820D2BC6FD9B824249FD5CA6E5279339CDD7A7DBA710EAA6778AD6<br>06093AA878E021BDAAD591B4BC17E4E13C75393C5C1D8C4065592E9038195790CA1514211EF7C785C3CB2A583A87E52D71B0B4EEB841574B4DB398E00FDA<br>D9AAF9FEE03234D95C4E9624B8B066C3E991FF8C9ED54C37D7547B292FDC1FF20DDDAD10E3377BECB5BF796DBB3814E30D66C6D4CA27CD7C5C5FA18A758B<br>8C21B324CD071683F33DD764EA3A77144A54A37EB97EB12B3AFB859413D12C66E05B36818459AB70AAF189C274A18CCE3BD36880959AA816E3936F0091CA<br>EB7D706351C38B7CD0DD9CCB4413ABE7038C456498E450473CBED4B3DE045A1788BCF0642EC991B4AF0B44CC206CFA61D5706D0B2E828991DBB8F4969255<br>0B3B48E8B50E35D6095ED098B79C22F1369E9B6AF0B78D3DF5D2A98ADEBA932D27D3F865F83866BA45CF714DFABF653134ABBF6338EC977FF4236E51C993<br>9ECE95140DD355CF4A2828B4F83E</span>
<br>
</div>
<div class="footer">
<div class="tl2">
Attention!
</div>
<div class="bg2">
<div class="text">
<div>
- Attempts of change files by yourself will result in a loose of data. <br>
- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.<br>
- Use any third party software for restoring your data or antivirus solutions will result in a loose of data. <br>
- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.<br>
- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
Targets
-
-
Target
124c65d01c6ba01dead43e246ae4c300d7345c8f46ae71ebf101bef5510f35aa
-
Size
667KB
-
MD5
dbedb905796795de32272ea95c45a36a
-
SHA1
76354f7b2a20d76f82343e0d01c8710600d01483
-
SHA256
124c65d01c6ba01dead43e246ae4c300d7345c8f46ae71ebf101bef5510f35aa
-
SHA512
871def3ab6253a2dfae41b5dc6bf19461bca16e234ff94165e7e25aeee79563c0a074304f0627104f76871961dd7c421dd8fa277f821cf6dfa150d61a4105b4e
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-