General
-
Target
svhost.exe
-
Size
678KB
-
Sample
221117-g2sz2ahg61
-
MD5
5aa0a571567f8437556e9b00ae5a3532
-
SHA1
45377cb152832c9112db7909219fa87a6e760aae
-
SHA256
73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
-
SHA512
d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
SSDEEP
12288:cPJ4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7:JRTYVQ2qZ7aSgLwuVfstRJL6YM
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">3CC1DEAE0E7CC3C82C62B472124F50ADE721272201DA2791C3B7BE5AF037EAD6BBF158389FF517B49B67CE105289EA60AB0FC2F829E49EA9E8DED21B1001544E<br>7AEE4B9F34B7042EC3DDA9C1610BA1B42B44A2F248FD50F85BA5904A79DD8DE9ED7DDA4B9807FB72E1BB96340386C841B2BFB3A9E731931055FB0CE4A427<br>CFAE525BC0FDCF2B29D26B1798F46C233D28A977F41FF8199936F868E3D57A4BC1EE8093D46CA1B6CD1539AF16CEE2413E0F014FA058247822445BAC6B89<br>02F71F1C996BFD9D30BFDD9F441DCE2E78C8C7D58DEAF1976206A99691276DD6203FD192BFA2FDAD114E1240DF8D112CDE602EE10894ADFC2B73BC8BF598<br>2C69D8AAC0BC20A36119955A62C44490F15FFAA1CE96479D225A59E082BD7BA2028BBAEDED16F0E355360FFFCDDF5DA73ED1AF81B6B1F0CA0E5A4C0CE349<br>E81659AEE922A934CAB67DBB96DB443E67541D2FF62526BDEE1397759A1A18E8FB32EA649ED34D025E109C1F80A0FB55EC6E77143318FCCE325FE3A3943E<br>D01D44A4D56E149CF4C505BE7ADF75C100093F36B0679B6F66AAA57C35BD5F3E4E37B35385A8CC86B8F66B8DD078D6CDF2B22C9BAC5D49454FCA78D5A675<br>42B7C3E629FEF91CB11DBC68E5B3BA3C68E3B2F173200EAAC09875ACDD7F7D2962774FEC681243F76467CD9248C22FC57742D35C6D16455B3D5D516EC27B<br>2B17DCBE1F8163AB2582310DE13B</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-9One4w8FvjhYZkcKvsbEI2UvnGHl7qg7</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">3DAB91E8B2232B80EB28438F2EA907088548772DAF8D788F42605285DF1D81881141FE849AD01AC8B70B9E0682B686F56831A7CF1967D58C8645C5412D9F3F44<br>7903AB54AF8C255E750FBB5354F03C0B0D3F69C7CAA2A9FB1C1F5C1729615DB28678E49EF1D0CC65DD93044B8BD3093AED2343AC0DC74356703864E46740<br>A2B7FD18CC59F988922D4E890A15DC07209BE7920839EA2A36DF17E3962DE01B6A1E9203F586BF22680CF89CCED4F7E51C190A664D05E758AA438F189CC2<br>075399D31EBA17E380F9874321C4740143F336660723DBB34CE43546F5FFD6DC2A44DB83A39E0BA66CEED051B206045581509E5DD9B0FFC2870C2C709ECF<br>5610412EE190D49F090DDB2E7BC44E4628BC79783F8AB9B46BBC4D57C46DD7E087E7D18F97E9FB0F55A184A6BE5F1C36380F5804F4CDF7B976E40D745420<br>D805EA390BAF8706BD7338EFD9D8C8E50CC230A70A376DBD53E31B13869B4681426F734151B233DACBC9CA912CCAAB1B90BAD2EF4DF80AEE321DF0FA1212<br>6C6E0745B7CAAE77AE0C09A74B963CD35A10F657BC1C868EF9FD518B5A4E3845224B223628C901CB4A5090ECAD3C23D5549FE6C280C9046AFA5F4E5932A7<br>1CD3C6388A02FFCD93507064D33DDB61C671108D32DC4545FDCF612752EB3C9BA56467F3E9E76F81FEC7F05524FC490C1DB7924D0C5155DD239BE5AC7AAF<br>291422B1A7531330AEE50702DE2F</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-rbyqjU67Kgs8bPNZj9nS7P4JQXmqi87n</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Targets
-
-
Target
svhost.exe
-
Size
678KB
-
MD5
5aa0a571567f8437556e9b00ae5a3532
-
SHA1
45377cb152832c9112db7909219fa87a6e760aae
-
SHA256
73549f6017ad04e475e40e9d306b3e042d080843d8e7c029a5bb6b8ab7e34432
-
SHA512
d320fecef75b4514b9cf154d41c3cc03e2cd8f6bf15ff0d7c97398127c0728cf0b24e5a46435573d38b384b1515876070f28daa7d37e81de10d1db2b27ae51ec
-
SSDEEP
12288:cPJ4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7:JRTYVQ2qZ7aSgLwuVfstRJL6YM
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-