Overview

overview

10

Static

static

10

Medusa.bin.exe

windows7-x64

10

Medusa.bin.exe

windows10-2004-x64

10

Resubmissions

13-03-2023 21:04

230313-zwvwjsca84 10

11-03-2023 04:46

230311-fdzbgaac8v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Medusa.bin.exe

  • Size

    661KB

  • Sample

    230311-fdzbgaac8v

  • MD5

    19ddac9782acd73f66c5fe040e86ddee

  • SHA1

    24ceba1e2951cde8e41939da21c6ba3030fc531d

  • SHA256

    dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

  • SHA512

    e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4

  • SSDEEP

    12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      Medusa.bin.exe

    • Size

      661KB

    • MD5

      19ddac9782acd73f66c5fe040e86ddee

    • SHA1

      24ceba1e2951cde8e41939da21c6ba3030fc531d

    • SHA256

      dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

    • SHA512

      e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4

    • SSDEEP

      12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks