General
-
Target
0a82724cfb44769e69d75318b0868cd6de4aa789951362b3e86199e6c7922610
-
Size
669KB
-
Sample
220201-tbbz2shael
-
MD5
50cb8959fad4a94b2c6927325e46306d
-
SHA1
1db0f2a6e3415f49681ee56bba524e3ad4a3810e
-
SHA256
0a82724cfb44769e69d75318b0868cd6de4aa789951362b3e86199e6c7922610
-
SHA512
8cf27998b78ea09acfcc137d92763836841b1cbbf0719c47b59797d8f88962eee74c8f8e5e4e4a77d0af50fc7b056cee270204a61cb39796a87935da0467dc07
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\RECOVER_INSTRUCTIONS.html
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section {
display: block; }
body {
font-family: Tahoma, Arial;
background: #717798; }
.all {
max-width: 1170px;
margin: auto;
background: #000;
min-height: 100px;
border-radius: 10px; }
.tl {
text-align: center;
color: #e03930;
font-family: Tahoma;
font-size: 28px;
font-weight: 700;
position: relative;
height: 60px;
line-height: 60px;
}
.close {
padding: 15px;
width: 36px;
height: 36px;
position: absolute;
right: 15px;
top:0;
}
.bg {
background: #252a42;
text-align: center;
color: #ffffff;
padding: 25px 15px;
font-size: 18px;
font-weight: 400;
line-height: 20px; }
.bg span {
color: #f25252; }
.bg a {
color: #9676fd;
font-size: 20px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.bg c {
color: #f25252;
font-weight: 500;
font-size: 20px;
line-height: 35px;}
.footer {
padding: 15px 0;}
.tl2 {
text-align: center;
color: #e03930;
font-size: 25px;
font-weight: 500;
line-height: 32px;
text-decoration: underline;
padding-bottom: 15px; }
.text {
min-height: 192px;
color: #ffffff;
font-size: 16px;
font-weight: 500;
line-height: 24px; }
.text div {
padding-right: 50px;
padding-left: 50px; }
@media (max-width: 767px) {
.tl {
height: auto;
padding-right: 50px;
line-height: 1.5;
}
.text div {
padding: 0 15px; }
.footer {
background: none; } }
</style>
</head>
<body>
<div class="all">
<div class="container">
<div class="tl">All your data are encrypted!
<div class="close"></div></div>
<div class="bg">
<c>What happened?</c> <br>
Your files are encrypted, and currently unavailable. <br>
You can check it: all files on you computer has new expansion.<br>
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. <br>
Otherwise, you never cant return your data.<br>
<br>
<c>For purchasing a decryptor contact us by email: </c><br>
<a href="mailto:[email protected]">[email protected]</a><br>
If you will get no answer within 24 hours contact us by our alternate emails: <br>
<a href="mailto:[email protected]">[email protected]</a> <br>
<br>
<c>What guarantees?</c> <br>
Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us.<br>
To verify the possibility of the recovery of your files we can decrypted 1 file for free. <br>
Attach 1 file to the letter (no more than 10Mb). Indicate your <b>personal ID</b> on the letter:<br>
<span style="width:800px; word-wrap:break-word; display:inline-block; color: #ffffff; font-size: 10px;">C0EBA4C5C51E83E1C38BA8BCBD989EB490564C86C15EFC5DB82F5F27B898003B341F27AD2FE566FC32A95D786B3A7327CB34E28DF60BC02D610AAC7438B26809<br>52A7E21F96539BF8CBB5DF22C02069780405C3EE9F9DAA097806D38CE8C7A9D8DEA0B895C3DC26DAA7122A2B8B8E7267AB4B22C09F6F9D1A2F6BC43BADD3<br>8936659BAEB8352B6E3EC8E9C4F4065C3D12D2A0B4A93452D0B96A1582EF623DB7C1B452E78B85053CD430BC186E3E300C92003734AE374C3CA4FF482F09<br>5CB18AE88F23AAAA66E1D6FF1AD05161420C17DBDFA19BABFD3217948156F3A3D2708F75B2DE3D7ADF629C0B39524AD58400FC45823F2E3B94DC21842200<br>E726E7008DC57EC7CBC20100AB4DB1837B8A373787FDF4D803D87B858F4485E0BBB1859F5093DB3F94BB35DB0661965595350730F59EFACA0ADD41CFD740<br>63715DD17A86BCA4A54BA4933119A85AE7190306DC7851974E76E423F5A74A091C88284A1DB51B388D4A1AD02EB2C16ABC522D660EF559FE37A374712C6F<br>1D191D73B6F16211E9D164E8BDDA60C66AE527FDE009DCDA72DADFB03E5ED3126DAAE838D663BF6D009CCDB62C78E7642C6051C4A29FEE2DAB90B143671A<br>5F27A3E0E2C9B594AC739088A3DCDD7FF244027F1E19B2987878302A2527D62081D8D4FE682AB20EBBDCA1246D7417D9AF0C969D39C9ECC82432797789E0<br>B997ECF8A7F4FDA075A6BFF4234B</span>
<br>
</div>
<div class="footer">
<div class="tl2">
Attention!
</div>
<div class="bg2">
<div class="text">
<div>
- Attempts of change files by yourself will result in a loose of data. <br>
- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.<br>
- Use any third party software for restoring your data or antivirus solutions will result in a loose of data. <br>
- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.<br>
- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
Extracted
Path
C:\RECOVER_INSTRUCTIONS.html
Ransom Note
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=Edge">
<meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, user-scalable=yes">
<title>Title</title>
<style>
html, body, div, span, applet, object, iframe,
h1, h2, h3, h4, h5, h6, p, blockquote, pre,
a, abbr, acronym, address, big, cite, code,
del, dfn, em, img, ins, kbd, q, s, samp,
small, strike, strong, sub, sup, tt, var,
b, u, i, center,
dl, dt, dd, ol, ul, li,
fieldset, form, label, legend,
table, caption, tbody, tfoot, thead, tr, th, td,
article, aside, canvas, details, embed,
figure, figcaption, footer, header, hgroup,
menu, nav, output, ruby, section, summary,
time, mark, audio, video {
margin: 0;
padding: 0;
border: 0;
font-size: 100%;
font: inherit;
vertical-align: baseline; }
/* HTML5 display-role reset for older browsers */
article, aside, details, figcaption, figure,
footer, header, hgroup, menu, nav, section {
display: block; }
body {
font-family: Tahoma, Arial;
background: #717798; }
.all {
max-width: 1170px;
margin: auto;
background: #000;
min-height: 100px;
border-radius: 10px; }
.tl {
text-align: center;
color: #e03930;
font-family: Tahoma;
font-size: 28px;
font-weight: 700;
position: relative;
height: 60px;
line-height: 60px;
}
.close {
padding: 15px;
width: 36px;
height: 36px;
position: absolute;
right: 15px;
top:0;
}
.bg {
background: #252a42;
text-align: center;
color: #ffffff;
padding: 25px 15px;
font-size: 18px;
font-weight: 400;
line-height: 20px; }
.bg span {
color: #f25252; }
.bg a {
color: #9676fd;
font-size: 20px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.bg c {
color: #f25252;
font-weight: 500;
font-size: 20px;
line-height: 35px;}
.footer {
padding: 15px 0;}
.tl2 {
text-align: center;
color: #e03930;
font-size: 25px;
font-weight: 500;
line-height: 32px;
text-decoration: underline;
padding-bottom: 15px; }
.text {
min-height: 192px;
color: #ffffff;
font-size: 16px;
font-weight: 500;
line-height: 24px; }
.text div {
padding-right: 50px;
padding-left: 50px; }
@media (max-width: 767px) {
.tl {
height: auto;
padding-right: 50px;
line-height: 1.5;
}
.text div {
padding: 0 15px; }
.footer {
background: none; } }
</style>
</head>
<body>
<div class="all">
<div class="container">
<div class="tl">All your data are encrypted!
<div class="close"></div></div>
<div class="bg">
<c>What happened?</c> <br>
Your files are encrypted, and currently unavailable. <br>
You can check it: all files on you computer has new expansion.<br>
By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. <br>
Otherwise, you never cant return your data.<br>
<br>
<c>For purchasing a decryptor contact us by email: </c><br>
<a href="mailto:[email protected]">[email protected]</a><br>
If you will get no answer within 24 hours contact us by our alternate emails: <br>
<a href="mailto:[email protected]">[email protected]</a> <br>
<br>
<c>What guarantees?</c> <br>
Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us.<br>
To verify the possibility of the recovery of your files we can decrypted 1 file for free. <br>
Attach 1 file to the letter (no more than 10Mb). Indicate your <b>personal ID</b> on the letter:<br>
<span style="width:800px; word-wrap:break-word; display:inline-block; color: #ffffff; font-size: 10px;">F2E8160A1D94E1260F23676C3813ED0EE3A0C8C128A4E176CBE642150D12774F24B3EDB7C29ADD59284C4E6754D1C3F97B230E0AFA060AC023F870B500F4E703<br>3343B4A3AD925F12795F26BFDE79A4315BB87C35AC4AED4ADF72E835B48FBAC219128F935B3207CB9CA1C7AEC6D26EEDF3B628C7258D1683300190F71480<br>8C194228369E71BAF28E8D61C746424D1859F8BAEB03090E2C403F65DB97644D972EDBC59753D450565DCF959155B24CA0A0D41EAEEC321F3715B2DD6980<br>5094A38A6B5E66ABCC5AA917F45E6E8C8722910E65A5B792F7C5E6B7D4CAA0A7013B8C7E09C35174291E5D9517CD1DC59F81DD1648A41758F8876B4DDBF3<br>BB8E7C69C2B0546268274F8D65D98FE7498B30F2582593D83E9A0056C3FE778FD30D9AF59F87F1A213287AEE04243DEBE10F8C6F1AB7157DFF3A6C008299<br>591A9B7BBF15714C1F5FB06842DD0426F7B808DA7AF740A11CA8C37687D942607D2851E26033EF596F00AF5112D540001D41ED59EF2E6FC449DD59CCD6FA<br>3F04462087CF2B38D95D51BC8D19F8AEC71FDACB9A3A17644E5FF1FEFC67EFC33AA59607D3BBE19F7618B6A8238621EC09B7E9152E97714AC25F074FFAB8<br>225957B6C95AC2308B2B7A6D22075C3CAC70A69113815CDBF847DAE4485EBACE1CFDF89EE7C9A35910C242D5115A8251373162467BE53FCAD5A5E1C75748<br>7FA56A81860058E9551B34A75794</span>
<br>
</div>
<div class="footer">
<div class="tl2">
Attention!
</div>
<div class="bg2">
<div class="text">
<div>
- Attempts of change files by yourself will result in a loose of data. <br>
- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.<br>
- Use any third party software for restoring your data or antivirus solutions will result in a loose of data. <br>
- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.<br>
- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
URLs
http-equiv="X-UA-Compatible"
Targets
-
-
Target
0a82724cfb44769e69d75318b0868cd6de4aa789951362b3e86199e6c7922610
-
Size
669KB
-
MD5
50cb8959fad4a94b2c6927325e46306d
-
SHA1
1db0f2a6e3415f49681ee56bba524e3ad4a3810e
-
SHA256
0a82724cfb44769e69d75318b0868cd6de4aa789951362b3e86199e6c7922610
-
SHA512
8cf27998b78ea09acfcc137d92763836841b1cbbf0719c47b59797d8f88962eee74c8f8e5e4e4a77d0af50fc7b056cee270204a61cb39796a87935da0467dc07
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-