medusalocker | a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf | Triage

Submit
Reports

Overview

overview

Static

static

a5fdfacc22...cf.exe

windows7-x64

a5fdfacc22...cf.exe

windows10-2004-x64

Sharing

General

Target

a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Size

669KB
Sample

220929-lqg6lsada5
MD5

225fef16f054c69c11dfc5a22007c650
SHA1

9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
SHA256

a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
SHA512

b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe

Score

10^/10

medusalocker evasion ransomware spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe

Resource

win7-20220812-en

medusalocker evasion ransomware spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe

Resource

win10v2004-20220901-en

medusalocker evasion ransomware spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
- Size
  
  669KB
- MD5
  
  225fef16f054c69c11dfc5a22007c650
- SHA1
  
  9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
- SHA256
  
  a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
- SHA512
  
  b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
- SSDEEP
  
  12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

medusalockerevasionransomwarespywarestealertrojan

behavioral2

medusalockerevasionransomwarespywarestealertrojan

© 2018-2025

Terms | Privacy