General
-
Target
medusa.tmp
-
Size
719KB
-
Sample
221116-l2bg7sea7y
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">21D384B0419344268B908C119D34DCAC6F41CB0A4516271E246BA678313B1E522BED92FD544F914C36CC8688183B9DD02A97D2DEDA236F83E3BA6C7783174863<br>D95734C21880A076631D728B8EE683EDCFD11D458923441F1D9E6BC045A91F8D321148CA49EA105E36DDBF5B47089A05B865AF346C36BABA7D116619FDED<br>91445E626762BE8A4114B589A66CB7E895283092B4F558DC315C34A71CBEC15F787904F59F75D32DA64316D284D574D448701500473AFD3F6A7E125CE8AE<br>0DDE5825E08AF5D848DFA03971666F93872A070B833EFD238F514676C7946B0DAA127913634929FCD031BAE96612ABB4E6BE75F56EBCCC39FD94935D299E<br>32991087B07301B92A0F44FA050DD67A3DBBCBF32B4FA5ADE081EFC8D34332DCF74ADE42C669630C792AD503A8C04C221D7F59B8942EE6E7598861478882<br>018CBEFF956D604F45D3F7DDDFBA5A909BC1047D6B5429AD9F2EC98C39510D7C80101FC739D48BEA1683970218BF471D81A661706B32B68BF5B5B6176783<br>F8451D51976A37D9EF2D435AC9878C0CCDAAC7CB9E73AA4C96A7B1397717227D545977DCD72A9F43C7D249F1EEE743FEAF5F3234D34EB58CB9492A52F304<br>4B779F18C9C0768B45CB163608D2F46551EE0304F4F5B57E8585F37D9462E6C7AD2A4D657BA818D6E45294689952ACEE9CD54AB09DC7BFC11BD40458482F<br>26A3467F6C6A1DD16C83F2F8DAA3</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-NpnxG6mV6VqPPEFYJnVbNEWpIq61e3G3</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">A99724D6D0790684D5DFDC8054EC91E0F1888C30E7394F2D3E8CF5CF9B4E6F3ADF00B13ACDCDF65A937642C30A5EE6AC05A5C34FC7670D35C4206DD1C76F9248<br>770BC70D5148EF40C02ECDA6B271DB99065CEB2F645EE2684C1D935119469301D263CD72D2F9F87D8AE675E29B83D292D11430ABD02440F0F13AE5460209<br>CA5F622F89D0A4FF27ACCA96204CCB2C01BDE0B88C1FA2CF8618D0A89E0886F4E431B7BF5F1425EBCD6C4F2569A4CD613F66A7275D04F109EABF842C2BF2<br>7AAFDAE53A500D10C2FB1A4B87A95ACFF4B036A9C319B4C11F2DB8FD917E4C5879DC14AD13A3F1CE5DFECF37E8374E7CBBD92F7DE8CD0CBD673E2A7FA409<br>83B879542FAF6160BC5D3F00EE03D28B4D5901D46A07BCA0D7FA9CF07DC2CDAEB622B9B284DA8953EF004B95D2CB4BCADEE3FC4C98CBF179C7D8481EC47F<br>6CBFA4BCE8E851505A914413CA071777CD6216C33E7B209AA808BF4776C3C3D65D3211B29B67CE3250B458C86C08A519DF3E9278F16D2BE4A1171CBCC6E5<br>32C937281E0509189CB3B97FBEFB0CB640A1E9DF78795D5F58F0778C21309A6D31F24775603BA0872F76DA48A42DFF01F0597DB433156F550432F04BB8C4<br>236159E8A5558426043CA621D38D30A7DA701EB5DAE8D00BF4D8BE449C5D16AB18D769F12785A7897BF3BFE63841695F70EA352496B7E9F4AFB5C66FA4CE<br>3D6E293CBA65B099C2AD800AE913</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-NpnxG6mV6VqPPEFYJnVbNEWpIq61e3G3</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Targets
-
-
Target
medusa.tmp
-
Size
719KB
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Score10/10-
Detect Neshta payload
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-