medusalocker

General

Target

dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.zip
Size

291KB
Sample

220408-pb5vxacfg5
MD5

c7e5d25820815b9439a954dde20f5359
SHA1

b367a72ea06bb57f6c062cd0a6a69832a3d68475
SHA256

737fcf0ec92cd062f0f196aa7d846808c28e5c20ccd651111c7ab737da79e047
SHA512

4d67072aa54bef908300b3d9fe42437216a888353e5d26666baaa7eb4b3fa0348e2196823c2298740916bb9b3e90124701b310d64aeae1774768d5064af780fa

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">DF8C4B09D45070991827C09EE32817CCAFED6DF84279DBA816EF1F150D11C893CDC37F7AE1DA89C15E2A0C349A5D037625A83E0015C0AF2A451604AFA77118C1<br>9440AAD292C43791E20138755BBA177C02EDE8A6CB38FDA418EBC4BEF0F2CA4F4F9C873B91A2C1616D9CC66C5C1EC8A07E28814CE07CFCD73B64BB58770F<br>6B54DD0C9A10B8F6FB6265E2E4E8243C224DE67A77BCC354DD0C0CD1C3B9FFF2D1702778FA2613405CE1F53B99E558DA97557A832FB1D476DD7BE330E757<br>ABFCADB47415AB52552ABBA384D456F7946A2D230AEBEE4D7746417C2C1F1E21323ACDCD95E1FFBAD3BAE4894931E21C9F0208410CE6E3ED03DE72C7F721<br>20EFC25B2519BE6671795799BB2C5CE943D0169F32524324CC0B363B5CEE1337D7294CD7D7AD0986BEDC6A0606136D41F8A4F7D1307A5BD896BDC7712A2D<br>B8847FBF31A80584450606D732B837D3D23532180B40E11BDEEFD62BB65B7AAE5F8F09E29211592186BF396A8CA9007E00913A0C5AF379712EADA71C7D75<br>6C27C00DE728847F832AB4793A9F0718061E1F56D94DF0C429B84595F4E9B4AC9E7E0219084B649607C3DC81B147A29421F1AFFDA862DFED4A1D1181A536<br>40A45F6836155A5A49A8892BE621F535B56466AA377D5FB7E8F90ECF55E9C175039C7C7E35B7DA40AE0261FCE2E0B039449BCE30EE00B23DE7EAAA1EFF39<br>A2181E189D6BAEC2F75A724D9836</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]

">[email protected]

href="[email protected]

">[email protected]

Extracted

Path

C:\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">E11BBAA6C600A83FE1707B42E8D86997774FEE57D3B80A480CABEF2171D4C249A16357C7725E4EC21C7E4B8F1793C1BA941258D2EDA7B8726F9F4FEF00C6191F<br>8C96586803FDDD675A6BDB16BFC0F76D550977C850A5167C4C379CD98DE59AF2227BFF79D806E1A95F4154F5C5E2496857CF0D9081B50FE27FDFA125E06D<br>8E8E69812F43EEA3408822651D8508BA758EC9D92521F322D908E4AC38DE9B5C0D1A06273474D4B2F8903EF396E1170CD57624D5DA2F2BDC143297C180FD<br>D243D9226FA89E74A0DB173F933F94BB336155778C84AA1DF8C9E201346BC3BBDB932B8BD08B64A1E28DB3E6DB40576FDC1093852A7BEC7A1C648F25F059<br>DDC40D37417CBB0EEC75CF7B68481D5598A660A9C7D6B8C39AB3F122BEC12BB40F4DA12934B6819E30370CBAC457A1F70FCBFF94CC0A8C89D15897CDEB13<br>9CB376F39EEEC195E4941BEFFB5EA7F3EEABCAF0D892E6E0F66BC80168065B5EE46C56E8AB53FC276FC7A499E6355E612834256FB0EBE47150FD6EA9AF75<br>17DF187B0ADE95156FE18C3FF2ACC99AF531DC3BE2D096C6BFCC7FB89E01028BC0F3E20313F1DBEF53BC17B70215F12A490F82C29A85CBEDD76E899AC435<br>2E324FA2891A3A3AB587D1265BA2CA0E194C8DD42F8252C5B22347349BCAA83326C261178ED83E8BC6D44304395FB995CC0A1A20073ECD546D195C9C5A58<br>DA827F1943C613988879D74F9618</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]

">[email protected]

href="[email protected]

">[email protected]

Targets

- Target
  
  dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
- Size
  
  669KB
- MD5
  
  3a43bb428e23e8059c9a3fbde9707de2
- SHA1
  
  edbca9b297c2ce981bcb6c8a20107c204045d523
- SHA256
  
  dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13
- SHA512
  
  c02648de56128a758873952ffcac982bf4463bc9c7cab9605e2f0cf77eb4304e39a9076494f4127718356e4d5250084353b27459c40ae8f30ac7cb5150f2ae1e
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker Payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2