General
-
Target
svhost.exe
-
Size
669KB
-
Sample
220204-dht67seec7
-
MD5
7de20a779f98016a31f2d47a64deb30a
-
SHA1
174375f8f540cb109cb8efea1cab30fc4155869d
-
SHA256
a3fe92224060ec183a25296999c18d4f86149649f1a701ac91b04d73e8678495
-
SHA512
bd3ff7efbf91e51d51ba8cb9529587500df721d9e631322f70a760b71f1fa0d8f2fecf4d0ab5ad2162ba75ae65aa5970edf8c647cbb8272bfc04a04189d31efb
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">5D37F030D43615B2E6B9709B14D70D470132E39B8B68893F91DCD07C71564C5F4E6FCF877006F0C604BEA92EB6B453A5D25020BDDA915D0DD31C41319493EDF5<br>65554B8DEB5E661ED31A295F1936B25CB4840F8B078FC889AB0DE7A1CC353E7AF6038E6C6DA1B2DA0171A4C0B573788DF1D055AC35B9AD3AB97D6C8F3A49<br>95293934C47BF3BB3484A01E532069246B58C0F6A9796AA7F40F751923893A0BCAC657D1CF9E104B3B356A30585309ECE60E778338326C63C971750AD5B2<br>36C810D1732CA813288043077F306C985BE89134BA6A8D5787386EB99F5FB00AF644DEBF8C18C8A6287A7E793D926ED5F15B295DA431EF611BE8813411CD<br>EFD2CFEE920C088B12DBD49A155782D39DD0982C606773A77857D29E4FB67383FBE964EEE6399201398FF0EDB6A16C471C5CB134029B18205EB3495C2967<br>09CD24F9ADAFBCDD09F53851B4AF92FCF24B712D57A637D3AC434CA59A05CF35826D48A53DEBBB528BCD3D604E3C512BE6AE85E48CE6FE3ADB8DE7B38E76<br>3B9D4C22CC2BDBA7CF9DB4544F874E9298BA043CACE42100CBC6B747542F4E2E0EA89C1ECC759FDE67710169308709E1AB8E18C956939DE40AC827037D98<br>6FCC7270A62CEC3B77620E0E4B91CD84D378D2FDA956787A2A1EAF12E1D04CDB9840531A3645A025A055581D10187B0FA27A10FEDF7466733D2368A493A9<br>EE159A5CBCDBA677A5EC43EAA071</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
Family
medusalocker
Ransom Note
Your personal ID:
5D37F030D43615B2E6B9709B14D70D470132E39B8B68893F91DCD07C71564C5F4E6FCF877006F0C604BEA92EB6B453A5D25020BDDA915D0DD31C41319493EDF5
65554B8DEB5E661ED31A295F1936B25CB4840F8B078FC889AB0DE7A1CC353E7AF6038E6C6DA1B2DA0171A4C0B573788DF1D055AC35B9AD3AB97D6C8F3A49
95293934C47BF3BB3484A01E532069246B58C0F6A9796AA7F40F751923893A0BCAC657D1CF9E104B3B356A30585309ECE60E778338326C63C971750AD5B2
36C810D1732CA813288043077F306C985BE89134BA6A8D5787386EB99F5FB00AF644DEBF8C18C8A6287A7E793D926ED5F15B295DA431EF611BE8813411CD
EFD2CFEE920C088B12DBD49A155782D39DD0982C606773A77857D29E4FB67383FBE964EEE6399201398FF0EDB6A16C471C5CB134029B18205EB3495C2967
09CD24F9ADAFBCDD09F53851B4AF92FCF24B712D57A637D3AC434CA59A05CF35826D48A53DEBBB528BCD3D604E3C512BE6AE85E48CE6FE3ADB8DE7B38E76
3B9D4C22CC2BDBA7CF9DB4544F874E9298BA043CACE42100CBC6B747542F4E2E0EA89C1ECC759FDE67710169308709E1AB8E18C956939DE40AC827037D98
6FCC7270A62CEC3B77620E0E4B91CD84D378D2FDA956787A2A1EAF12E1D04CDB9840531A3645A025A055581D10187B0FA27A10FEDF7466733D2368A493A9
EE159A5CBCDBA677A5EC43EAA071
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Extracted
Path
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">2D1C508BB9B3A6A7980E6DC7591D94DB819CC05A0EC782BE0B4F697790BAB16B077D0F0D346615249EA15D6E9B487812668BF66AADF6FDB10D9D4F9763AFECDB<br>127585BFAA470DA9D3195B94CAE2B241B76803502438650A6739D9020EF3EDE7FC553507417C3DCE1BA44AE792C6E20958876F230CD35BC23FD9FA409DFA<br>C82277FF38435D7BFC1B670E53503FEAB36851D8BF9F1718EB6D1D05D8CF7F196DACEA0FF76F7A3E653821ECE3726665373C716544A9A6053FADC4BEB727<br>40DDA3C136478C9C6DF468625ECF1D7EA20617D6D8CDE425B2E39FC6900D1B26CDD4A0D3A1B6A26C9F6BBABCF218A75DDFC9130E23191E2A58480C7507BF<br>FF3A29AA3D9A5100069A8EAD90F3157166447B06AC93FCBCF3092BAF976FD6D6B98E75C49EA57538BD680631D50F6B1868A63CD9F83FFBE044A154652F75<br>42E7F158D11061744B474816F5DB1DFC9C7FAE3356F0EBF3D93B342003A1E2762E094231C6C38D2A548EF486A01CA2E45EC10A5B4039EF0F74204E5CD9F9<br>9FEBF7496234D78F864718BFB69C6818EA46357B0A705EA96E77DA7ED2F0DE9885C375F0F05C2E297B19243AB144628E5A133CF230435421905E6B42C49C<br>436D80A43FE98E28ED5F51ED381D22BDC9B80C7200F65E25D2F66668234E4A0C300067A96876422C112C79EB9D51DDC365E11C0521A574F5289920E8C054<br>C1D366B3FD6F3C7F93C6639B591F</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
svhost.exe
-
Size
669KB
-
MD5
7de20a779f98016a31f2d47a64deb30a
-
SHA1
174375f8f540cb109cb8efea1cab30fc4155869d
-
SHA256
a3fe92224060ec183a25296999c18d4f86149649f1a701ac91b04d73e8678495
-
SHA512
bd3ff7efbf91e51d51ba8cb9529587500df721d9e631322f70a760b71f1fa0d8f2fecf4d0ab5ad2162ba75ae65aa5970edf8c647cbb8272bfc04a04189d31efb
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets service image path in registry
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-