medusalocker | b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009 | Triage

Submit
Reports

Overview

overview

Static

static

b00be4dda4...09.exe

windows7-x64

b00be4dda4...09.exe

windows10-2004-x64

Sharing

General

Target

b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
Size

669KB
Sample

221110-hs7bqsheej
MD5

ac546514c037b432430bebc8e3884dad
SHA1

f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
SHA256

b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
SHA512

b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWCKrKe

Score

10^/10

medusalocker evasion ransomware spyware stealer trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe

Resource

win7-20220812-en

medusalocker evasion ransomware spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe

Resource

win10v2004-20220812-en

medusalocker evasion ransomware spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
- Size
  
  669KB
- MD5
  
  ac546514c037b432430bebc8e3884dad
- SHA1
  
  f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
- SHA256
  
  b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
- SHA512
  
  b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
- SSDEEP
  
  12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWCKrKe
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

medusalockerevasionransomwarespywarestealertrojan

behavioral2

medusalockerevasionransomwarespywarestealertrojan

© 2018-2025

Terms | Privacy