Resubmissions
08-04-2022 14:09
220408-rgbv5aadhn 10General
-
Target
dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.zip
-
Size
291KB
-
Sample
220408-rgbv5aadhn
-
MD5
c7e5d25820815b9439a954dde20f5359
-
SHA1
b367a72ea06bb57f6c062cd0a6a69832a3d68475
-
SHA256
737fcf0ec92cd062f0f196aa7d846808c28e5c20ccd651111c7ab737da79e047
-
SHA512
4d67072aa54bef908300b3d9fe42437216a888353e5d26666baaa7eb4b3fa0348e2196823c2298740916bb9b3e90124701b310d64aeae1774768d5064af780fa
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">261314D9D877633E06D13F7005187C9DC4EBBDCF1B4D3594DC9C6E9B5BFDD068CD48DA79E53AE9D057B1E396683E0114B42B4B2139B092570450A4BC7CC1EDFF<br>97ED00F71E07BB15D725D61C9CC019826076C1E1BAA6717C9B371A3D5442CDB028FF85519587799676DEE5B2C28EEE25069154C203EFF57A63F42D62ED95<br>43779572201FA29EB28BCCADDA254B1A73D0906FCBED8A6C0870A3582616B6B5A4C52C6EA510CDCEF0115E6D313CAC54729BF68F006B2CF295E861D35779<br>FB11C852AEF4C988D3AB13B304F6F6E1687DD6B1208020923AEC486F68743FBD2AB041F74D381845C45314D1C189B2CA914E455AD017C0BF671EC21EBFB9<br>C49BF30D430076D79B469F92D2F09EB6CA7C16AF1A8FE9D51A25D1FE6100C69424AC77F041FBDAD0EB5F9DCF79D020072A33AA9EAFCC61B596941EB11EAA<br>72FD43C53CE1F7069CD23EF51EBB08C3E8A8AA30AD6624EE2EC1058E2115C347C6E1A26C69D20ACC5F542FBA6E719B07173FD3C66EBBD430686C7C7D74A1<br>96F3194B2FF561013FCE83FA1F2A2BABCF67D929EB9B6EA59AE06FDB8BFA70B05D8E6C29F9480831871DAC5892CF75568AA960C948A4B2DD6DBDB0770C9A<br>B5CCB6AAA0A31B163A76B3FA3CFB06D380515F8E6E7AA6C49776F6B382C8BE1F6042C0C933F0895E334BC535BFFA904587CF9CCEAC520E30DE7486BA0278<br>554FF66903E9203ADC3B111BA36B</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">69AA6A03E06294B6EA741E952382E41661E42DD978D4BCE0FE5D5EFE9145FBF5E21D7CBDADE911CE2C76452FF876AF647571E5C3A2251C83E42E40E6973158C8<br>DBA5DA4F791598CA08DAD6E8B9357C5B7F0492911F46CD53E4D7DF5A3BA2C84D826C78F6BE808CB5A54031D1E8861326BE5D55C2846A6599106F69A3695F<br>EC9EB389768D4C88FB6E50467E6D67A4BB9B26A8D52327607FC404E22927044DEF456DC118D19B856DFCDD5EBFD1ADA107A527EBB95F1CC2A297A5C1D1FC<br>CD499E2D3B0B7A0102489C157B08421A39F50A8CBB2CE4165C273488D6FFA9F4B73DCA97C225ED44F337F21B549E37028D69960C9AA27EDCF30128A56F74<br>02833D79651C4FC9DCC68444E69B2A27EDF9104B688DCED38E52FF539F42D05EC7AD562EECAA2583466738676473AF15F21D2C34D0274CFE706483013CD4<br>AB16A349C58876E2470210A8FDEA22D24AE0BD08B72C034E39350BD8C4D4DD61A3C8B4E527FEF747F173458F6FD3F6A37B552F9BCE5559A81CABAD9FDAC5<br>9954D6BE01B8C47331DA9AE3390A3F159C73D793678E82132D6C1091D31A934E877C8089B067FF42EA34B99A022B2515CE6611288B4D1EC0E91FDEB8BA5C<br>03D15F241D0DCA34B2132D47C056AACD044EAE26396D640183BD07CB24B377AADBA665A4CB60294A41922FBAE04A4DBC5FB32B233B67E36E3222753DC5F4<br>BE6F99E74216FB45C4A27F912E00</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
Family
medusalocker
Ransom Note
Your personal ID:
69AA6A03E06294B6EA741E952382E41661E42DD978D4BCE0FE5D5EFE9145FBF5E21D7CBDADE911CE2C76452FF876AF647571E5C3A2251C83E42E40E6973158C8
DBA5DA4F791598CA08DAD6E8B9357C5B7F0492911F46CD53E4D7DF5A3BA2C84D826C78F6BE808CB5A54031D1E8861326BE5D55C2846A6599106F69A3695F
EC9EB389768D4C88FB6E50467E6D67A4BB9B26A8D52327607FC404E22927044DEF456DC118D19B856DFCDD5EBFD1ADA107A527EBB95F1CC2A297A5C1D1FC
CD499E2D3B0B7A0102489C157B08421A39F50A8CBB2CE4165C273488D6FFA9F4B73DCA97C225ED44F337F21B549E37028D69960C9AA27EDCF30128A56F74
02833D79651C4FC9DCC68444E69B2A27EDF9104B688DCED38E52FF539F42D05EC7AD562EECAA2583466738676473AF15F21D2C34D0274CFE706483013CD4
AB16A349C58876E2470210A8FDEA22D24AE0BD08B72C034E39350BD8C4D4DD61A3C8B4E527FEF747F173458F6FD3F6A37B552F9BCE5559A81CABAD9FDAC5
9954D6BE01B8C47331DA9AE3390A3F159C73D793678E82132D6C1091D31A934E877C8089B067FF42EA34B99A022B2515CE6611288B4D1EC0E91FDEB8BA5C
03D15F241D0DCA34B2132D47C056AACD044EAE26396D640183BD07CB24B377AADBA665A4CB60294A41922FBAE04A4DBC5FB32B233B67E36E3222753DC5F4
BE6F99E74216FB45C4A27F912E00
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Targets
-
-
Target
dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13.exe
-
Size
669KB
-
MD5
3a43bb428e23e8059c9a3fbde9707de2
-
SHA1
edbca9b297c2ce981bcb6c8a20107c204045d523
-
SHA256
dbac4f2fffcb4e09aad772895647e8f161b1ac713592fe47c5e8207c85722f13
-
SHA512
c02648de56128a758873952ffcac982bf4463bc9c7cab9605e2f0cf77eb4304e39a9076494f4127718356e4d5250084353b27459c40ae8f30ac7cb5150f2ae1e
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-