medusalocker

General

Target
svhost.exe
Size 669KB
Sample220204-dht67seec7
SHA256 a3fe92224060ec183a25296999c18d4f86149649f1a701ac91b04d73e8678495
MD5 7de20a779f98016a31f2d47a64deb30a
SHA1 174375f8f540cb109cb8efea1cab30fc4155869d
SHA512 bd3ff7efbf91e51d51ba8cb9529587500df721d9e631322f70a760b71f1fa0d8f2fecf4d0ab5ad2162ba75ae65aa5970edf8c647cbb8272bfc04a04189d31efb
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Path

\??\Z:\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">5D37F030D43615B2E6B9709B14D70D470132E39B8B68893F91DCD07C71564C5F4E6FCF877006F0C604BEA92EB6B453A5D25020BDDA915D0DD31C41319493EDF5<br>65554B8DEB5E661ED31A295F1936B25CB4840F8B078FC889AB0DE7A1CC353E7AF6038E6C6DA1B2DA0171A4C0B573788DF1D055AC35B9AD3AB97D6C8F3A49<br>95293934C47BF3BB3484A01E532069246B58C0F6A9796AA7F40F751923893A0BCAC657D1CF9E104B3B356A30585309ECE60E778338326C63C971750AD5B2<br>36C810D1732CA813288043077F306C985BE89134BA6A8D5787386EB99F5FB00AF644DEBF8C18C8A6287A7E793D926ED5F15B295DA431EF611BE8813411CD<br>EFD2CFEE920C088B12DBD49A155782D39DD0982C606773A77857D29E4FB67383FBE964EEE6399201398FF0EDB6A16C471C5CB134029B18205EB3495C2967<br>09CD24F9ADAFBCDD09F53851B4AF92FCF24B712D57A637D3AC434CA59A05CF35826D48A53DEBBB528BCD3D604E3C512BE6AE85E48CE6FE3ADB8DE7B38E76<br>3B9D4C22CC2BDBA7CF9DB4544F874E9298BA043CACE42100CBC6B747542F4E2E0EA89C1ECC759FDE67710169308709E1AB8E18C956939DE40AC827037D98<br>6FCC7270A62CEC3B77620E0E4B91CD84D378D2FDA956787A2A1EAF12E1D04CDB9840531A3645A025A055581D10187B0FA27A10FEDF7466733D2368A493A9<br>EE159A5CBCDBA677A5EC43EAA071</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Extracted

Path

C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html

medusalocker

Ransom Note

Your personal ID: 5D37F030D43615B2E6B9709B14D70D470132E39B8B68893F91DCD07C71564C5F4E6FCF877006F0C604BEA92EB6B453A5D25020BDDA915D0DD31C41319493EDF5 65554B8DEB5E661ED31A295F1936B25CB4840F8B078FC889AB0DE7A1CC353E7AF6038E6C6DA1B2DA0171A4C0B573788DF1D055AC35B9AD3AB97D6C8F3A49 95293934C47BF3BB3484A01E532069246B58C0F6A9796AA7F40F751923893A0BCAC657D1CF9E104B3B356A30585309ECE60E778338326C63C971750AD5B2 36C810D1732CA813288043077F306C985BE89134BA6A8D5787386EB99F5FB00AF644DEBF8C18C8A6287A7E793D926ED5F15B295DA431EF611BE8813411CD EFD2CFEE920C088B12DBD49A155782D39DD0982C606773A77857D29E4FB67383FBE964EEE6399201398FF0EDB6A16C471C5CB134029B18205EB3495C2967 09CD24F9ADAFBCDD09F53851B4AF92FCF24B712D57A637D3AC434CA59A05CF35826D48A53DEBBB528BCD3D604E3C512BE6AE85E48CE6FE3ADB8DE7B38E76 3B9D4C22CC2BDBA7CF9DB4544F874E9298BA043CACE42100CBC6B747542F4E2E0EA89C1ECC759FDE67710169308709E1AB8E18C956939DE40AC827037D98 6FCC7270A62CEC3B77620E0E4B91CD84D378D2FDA956787A2A1EAF12E1D04CDB9840531A3645A025A055581D10187B0FA27A10FEDF7466733D2368A493A9 EE159A5CBCDBA677A5EC43EAA071 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

Extracted

Path

C:\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">2D1C508BB9B3A6A7980E6DC7591D94DB819CC05A0EC782BE0B4F697790BAB16B077D0F0D346615249EA15D6E9B487812668BF66AADF6FDB10D9D4F9763AFECDB<br>127585BFAA470DA9D3195B94CAE2B241B76803502438650A6739D9020EF3EDE7FC553507417C3DCE1BA44AE792C6E20958876F230CD35BC23FD9FA409DFA<br>C82277FF38435D7BFC1B670E53503FEAB36851D8BF9F1718EB6D1D05D8CF7F196DACEA0FF76F7A3E653821ECE3726665373C716544A9A6053FADC4BEB727<br>40DDA3C136478C9C6DF468625ECF1D7EA20617D6D8CDE425B2E39FC6900D1B26CDD4A0D3A1B6A26C9F6BBABCF218A75DDFC9130E23191E2A58480C7507BF<br>FF3A29AA3D9A5100069A8EAD90F3157166447B06AC93FCBCF3092BAF976FD6D6B98E75C49EA57538BD680631D50F6B1868A63CD9F83FFBE044A154652F75<br>42E7F158D11061744B474816F5DB1DFC9C7FAE3356F0EBF3D93B342003A1E2762E094231C6C38D2A548EF486A01CA2E45EC10A5B4039EF0F74204E5CD9F9<br>9FEBF7496234D78F864718BFB69C6818EA46357B0A705EA96E77DA7ED2F0DE9885C375F0F05C2E297B19243AB144628E5A133CF230435421905E6B42C49C<br>436D80A43FE98E28ED5F51ED381D22BDC9B80C7200F65E25D2F66668234E4A0C300067A96876422C112C79EB9D51DDC365E11C0521A574F5289920E8C054<br>C1D366B3FD6F3C7F93C6639B591F</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Targets

- Target
  svhost.exe
- Size 669KB
- SHA256 a3fe92224060ec183a25296999c18d4f86149649f1a701ac91b04d73e8678495
- MD5 7de20a779f98016a31f2d47a64deb30a
- SHA1 174375f8f540cb109cb8efea1cab30fc4155869d
- SHA512 bd3ff7efbf91e51d51ba8cb9529587500df721d9e631322f70a760b71f1fa0d8f2fecf4d0ab5ad2162ba75ae65aa5970edf8c647cbb8272bfc04a04189d31efb
- MD5 SHA1 SHA512
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan persistence
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker Payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Sets service image path in registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2