General
-
Target
c79c6b680a2caa71b3ad052f60ce6da463eb576b8196bb3bbdccd003853769d4
-
Size
669KB
-
Sample
220408-mwp9vacdf7
-
MD5
87142e82f1cb0ecbcee7167ce8a183af
-
SHA1
f80b1b3435a09a6b66e0bc5188892f0790ca2faa
-
SHA256
c79c6b680a2caa71b3ad052f60ce6da463eb576b8196bb3bbdccd003853769d4
-
SHA512
ff44ab7a94ad1fbf5b773b3b8aed8fc40ad142bfe8c6b91991c0237b300ec39922f4840945e5369f70bbc673f2b0ca509d4eb0a287ef42364784e7ceec17f8fa
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">A21E48ED37B3710A4FAF2EC11F2CA9E711628949AEB90FA7893681D7A025DC81C940E83D4DD327C591ED81C91EB42B9E9F31D871587C46176DA7675C0F3004C4<br>1070A39010C1259C9424064DA097EB01D136E5B99E9AF0143C783DF0A600704B061AC0DBD1D3CD9958A46EAC6776E75151871B5A7E3E84D916B74E777E6D<br>24F23A985DB0879A52D46A4F4CEAE55BB7778C83ADDAEED29D0D2AAD94233EC0B694B46FB02F46F6A01AA95716D1276DD7F3DD1132C71BA4F16A93653F24<br>69C5172DD3A2C1C27F494E906679C1A024AD9F91318917C13F3C6A1D81EBB1CD800D037E28A4F5C0A151204D20126D7F8EE95DA9CF6E3F6F8B8BE9ECCE01<br>FBB0318C158AA74DCC5553DDD9E5B9260043D63AE970FA8313FE6F6903D21AF3E4F6AF3C080E67F3DDA54CF0D66B8BF13AE3697C7782E5C1DDA8DDD1AF59<br>A0D81126D13DEA57E9B329E86374FF54BF42C93B6ACFF46DAE47CA04E216D72080CFF598F263CAA42B9E9673AF5B72F2F220CFB9421DB015C1D5D9C5F43E<br>5AD0CF97890A90948B6BADFB851645145C5E264C70D6FF2700219F13AD9E28E433CE6125F5016FF21F839979945814126B0126703CD315A7A3407E63B81B<br>B9A569617E7B9FE73D120B607BCC5F66B12A319ACC81210C67A7CE101A4410148BDEB97C45C1A597ADEAF9E3A4478D620473E77396315010B6BDF62D2222<br>8CA09B80766B94B3FF887EC52F0E</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">04D4E6D9C8B5CA233AD6E93A74DDFBE9034837941AEEBFBA7CAD4203AA00FEAC320F556BE08CC361DC9255DDADC685316192431E58A0639EFF99FBAA677FC09D<br>0E163E94D17C3F90FACF041025974CB252EB30E738D202E733B49337DED7524E8AAB4F48789450D37EAE4657994B024B99B07D72180404775010A0B530DB<br>E83966623D61FE80259876332E01CF0C580FCC08B394D00AB28398878CBE576CF2FFE0991460407C82E9A0AE2C9AA4E8CE71F87C4A952577CA491D2167C8<br>1285E331DE3AFA5D0EA66764D7C2A2BFAF7130BA27FB4D135D3B43AD1E09EC8AC0307EFF42276EFFB47220DA21445D449781194E8474C65542CE762EE75E<br>A948762CE374133BAD8E4F421262160B70076F791D5F63D304C81162BF7D748F8161DF6724F78E0DF6C95EF0020F10A285B250C5F212C829C61D334B9605<br>192BA6EA0289526AA86A1F8B67152ED325E433A8F684A59D2776A1348F60CC9215EE5644260286FDBD1A2C88D4ABDCE028A45B7838DB44083D04D0C98246<br>613872EBCDD4BAAED9B1D5232BC81A3D09C4C358EDD60478FABE66EA345477F3BAD0DC4EA7328E4DF549440CC8DCC4328569E011471D30EE289302021DC6<br>F323393EEA10CE1CDF80C995BCB732F33771BC494F3D7FA5507BFB87307186BBC5296F3880F6E9628D0344642D53DA79400C7C8F844D50E9290DBF62BADF<br>A42558B7A6A99161A536711E2AA8</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
c79c6b680a2caa71b3ad052f60ce6da463eb576b8196bb3bbdccd003853769d4
-
Size
669KB
-
MD5
87142e82f1cb0ecbcee7167ce8a183af
-
SHA1
f80b1b3435a09a6b66e0bc5188892f0790ca2faa
-
SHA256
c79c6b680a2caa71b3ad052f60ce6da463eb576b8196bb3bbdccd003853769d4
-
SHA512
ff44ab7a94ad1fbf5b773b3b8aed8fc40ad142bfe8c6b91991c0237b300ec39922f4840945e5369f70bbc673f2b0ca509d4eb0a287ef42364784e7ceec17f8fa
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-