General
-
Target
88e0a638db0258409c7458b15634be4cbefe4f6438ee39ab61c2699c18997c5f
-
Size
678KB
-
Sample
220306-ezc5paaaa6
-
MD5
c627f3efbd8ac9d105bbbbabede03292
-
SHA1
6da7954690a43c7355b494f069afab03c41f2550
-
SHA256
88e0a638db0258409c7458b15634be4cbefe4f6438ee39ab61c2699c18997c5f
-
SHA512
80c569c83412f4ed8257de33eb5b77d0cc2e046c8c9a3dd1ff4404cc2f6309a0cf2f1cb1cb0bef13e445d9f2ab94a864225375d1c11156d52b859bbfa041cc7b
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">1600ABB03B757356B9B72734A9BEA905007F4410C12B3C69B51C1C2F4FBF0A1956572FC34F8AF9F04E4ED66B15099D43BB12D2976447B627E74B7C9216CAE399<br>5D9527350430A220240495883E15C23A169BC58FA018E16AC062B6A5D2E0AEA9ECF3B94542868EA0F280803BA0DB5BA95ED87FBE2A500B1B2215712A615B<br>E83BA4021735502DA25DE1B4B6650BAB6178DCFCC59CA38F35C72E12F934835EDE5D34F0B1C5CAC3E178925C2BBB20CBD0CA744DDF669E6237CEED399830<br>FDAA73450289F09B2E68EBA01C0CB091EE31229E086F21C1034D7AD4CF33D9C698649DE47708E928472BC1130348227668AB30B4C1F412FFC38273B4C93E<br>0BF4E591FE750E7A7E9C7E0CABF9B7010F0EA4BE17E934D868C51F620BC0762E371370E04EC3BB9E8FC57F41E96E51DBBD210995CE32518957D58F778D4B<br>7F92AAEBE6557F1F4639AD405547433B54CD8C112DE4E227A9EAB02C019FFFFEB89187DCF5DB69F025A7B46F60A88DFB7AC2B59C65454F301E6DAD41C3B2<br>001358C1DA32D00241DCD90758E143BB90D2C286E80FB09AF0BCA0AD8CB4A9991AB056CFF842A455F069009E46CF813019DD7BBCFDB776FF662A2B727EB3<br>089CE11BC69CC6AD9A5A593AE67A41EB385492B9C2195493CF66E21EB82D53678E0B95140C65EF77DD15BE38EAA14587A4E31B947D46FF02D8CF1EEB4706<br>5D8D415E6B686A19F90B9D6C683A</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a href="">http://gvlay6u4g53rxdi5.onion/36-PGl6TC3QXo6nRZpt4BWuBuyTVpMbQZLo-bqr9GCtQn1397EskbsNrHZ0mimpXQDhY</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<b>If you can't use the above link, use the email:</b><br>
<a href=" [email protected]
?
">[email protected] </a> <hr>
<a href=" [email protected]
?
">[email protected]</a> <hr>
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">3E91D59C5F0499C563CCD1EB4875B4811CFC588F16700298373E31BB964414DCA295463346CA8671C4CB2719C3AEE1F8AF431245FE00BF536590B5EC2317BAA1<br>62CC58A2112E38540EFEC66FEDDCD6D1A6C4DFF0C3D29F513FE1B729C92D1437BB52DFFF8737122A936848D4E9FF74343446F51416DB0AF151047AC97626<br>7C1E988E43D4FDE7D24AE7AD3495102DFED10CE31932C8A3958A77173BC6A9C6B3E14E1D48B44B263907B8C7690AEDA731B720D9329AC2B68ABAE9E5F6C5<br>C8B4B9F17B3D217D2BBECFD6C067E1AD688167274E7DF11CACC27CB4DE6FD8E0A555E49F346324649B91D03E33894F8D454E311D868A0C036ADB85615F5D<br>CADB2573A1AF6D8DAB812FC6591A798B1206000827F2FCBEB9BE6638679D1C291554681CD00B8EDDBB0B305FA4A02922869F0DC96D4662F8E6928ACFAF81<br>FF558ED2A196520621E4433A5456B9C329BE72D7C43ABE249BB3603BBC41DED375532483AC591F2019FA345CEA2B19CC9D3920D1B9E2D2B46C1F603552A9<br>5B2FDDDF81C74DBCC0BF56AC64067B44640C80736FD2B96DEAF35F37DE4DC07BE8FC435007CA56E07B1F4CB2220331DBDDF66DE50AC1EBFA5346B83024EB<br>4686688151B1AC40DD04C2BA14804A0104C355F0BF4EEE040B52F21D13D77E12977F0C3A6ACB509BBAA65B0152B1F69349D127B7F13B6C41CE9DECA61666<br>BB39A1025BAA965FF877E8B5A22D</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a href="">http://gvlay6u4g53rxdi5.onion/36-PGl6TC3QXo6nRZpt4BWuBuyTVpMbQZLo-0rEilEylaU11ktZyXXClYZhOt6nTH7Uh</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<b>If you can't use the above link, use the email:</b><br>
<a href=" [email protected]
?
">[email protected] </a> <hr>
<a href=" [email protected]
?
">[email protected]</a> <hr>
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
88e0a638db0258409c7458b15634be4cbefe4f6438ee39ab61c2699c18997c5f
-
Size
678KB
-
MD5
c627f3efbd8ac9d105bbbbabede03292
-
SHA1
6da7954690a43c7355b494f069afab03c41f2550
-
SHA256
88e0a638db0258409c7458b15634be4cbefe4f6438ee39ab61c2699c18997c5f
-
SHA512
80c569c83412f4ed8257de33eb5b77d0cc2e046c8c9a3dd1ff4404cc2f6309a0cf2f1cb1cb0bef13e445d9f2ab94a864225375d1c11156d52b859bbfa041cc7b
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-