medusalocker | 9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9

Resubmissions

03/11/2022, 17:44

221103-wbk9tsdba910

01/11/2022, 06:02

221101-grfa7ahfcq10

Sharing

Copy URL Twitter E-mail

General

Target
9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9
Size 684KB
Sample221101-grfa7ahfcq
SHA256 9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9
MD5 d545dea5b0791f3cbf14b18a1fc38729
SHA1 90b4c7b024ed368be088731a806d4b17151ef610
SHA512 8ef6e15e39233e621f96d68b486e77c50578c443d2ac6c302442016c6a10d09bf9656a0c2df3dc7b9f9641412a82dd566e5668373662b6245b520aec6151f3d2
SSDEEP 12288:/uOY7FCI4WvZG5y0ntCt0GyFJeYYUHuqfzOzCIAQvuBz7h67RcZrSuj/KeX:tAwI4WhG5y0ntDGmJeYJuq9IAiup4aO6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

File Explorer

9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9

.exe 684KB

9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9

IMPHASH 1a395bd10b20c116b11c2db5ee44c225
SHA256 9daa97ef8b7fde13be1d7581ce3d2ae56cf3f5b659c26b9e011c08749571fef9
MD5 d545dea5b0791f3cbf14b18a1fc38729
SHA1 90b4c7b024ed368be088731a806d4b17151ef610
SHA512 8ef6e15e39233e621f96d68b486e77c50578c443d2ac6c302442016c6a10d09bf9656a0c2df3dc7b9f9641412a82dd566e5668373662b6245b520aec6151f3d2
SSDEEP 12288:/uOY7FCI4WvZG5y0ntCt0GyFJeYYUHuqfzOzCIAQvuBz7h67RcZrSuj/KeX:tAwI4WhG5y0ntDGmJeYJuq9IAiup4aO6
MD5 SHA1 SHA512 SSDEEP

windows x86

MedusaLocker payload

Minor OS version

Major OS version

Entry point

238375

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32NextW Process32FirstW CreateProcessW GetTickCount CopyFileW GetCurrentProcess WriteConsoleW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject TerminateProcess FindClose FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW FindFirstVolumeW QueryDosDeviceW GetEnvironmentVariableW GetLogicalDrives GetProcessHeap MoveFileExW SetFilePointerEx HeapAlloc CloseHandle GetLastError SetFileAttributesW GetFileAttributesW CreateFileW WriteFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetFileType GetTimeZoneInformation EnumSystemLocalesW HeapFree GetFileSizeEx GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetStdHandle ReadFile OpenMutexW Sleep CreateMutexW GetModuleFileNameW SetEnvironmentVariableW EncodePointer DecodePointer RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW WideCharToMultiByte MultiByteToWideChar FindFirstFileExW FindNextFileW GetFileAttributesExW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WaitForSingleObjectEx GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitProcess

advapi32

CryptExportKey RegCreateKeyW RegOpenKeyExW RegSetValueExW RegCloseKey CryptReleaseContext CryptGenKey CryptImportKey OpenProcessToken GetTokenInformation CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW OpenServiceW QueryServiceStatusEx CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey RegDeleteValueW

shell32

SHEmptyRecycleBinW

ole32

CLSIDFromString IIDFromString CoInitializeEx CoGetObject CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysStringByteLen VariantInit SysFreeString

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

IcmpSendEcho IcmpCloseHandle GetAdaptersInfo IcmpCreateFile

ws2_32

inet_addr

rstrtmgr

RmShutdown RmRegisterResources RmStartSession RmGetList RmEndSession