medusalocker | dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95

General

Target

Medusa.bin.exe
Size

661KB
Sample

230313-zwvwjsca84
MD5

19ddac9782acd73f66c5fe040e86ddee
SHA1

24ceba1e2951cde8e41939da21c6ba3030fc531d
SHA256

dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
SHA512

e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4
SSDEEP

12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\HOW_TO_RECOVER_DATA.html

Ransom Note

All your data are encrypted! Your files are encrypted, and currently unavailable. You can check it: all files on you computer has new expansion. By the way, everything is possible to recover (restore), but you need to buy a unique decryptor. Otherwise, you never cant return your data. [email protected] If you will get no answer within 24 hours contact us by our alternate emails: [email protected] Its just a business. If we do not do our work and liabilities - nobody will not cooperate with us. To verify the possibility of the recovery of your files we can decrypted 1 file for free. Attach 1 file to the letter (no more than 10Mb). Indicate your personal ID on the letter: 4C62F58FF7D01AC345C1E204EB1B968C035CAD34290E7A092788210E156365166AB40F48FDEE447D8EBDE7BDFFE8F7BB0D26B59FEEB5B7691DC8451B7E8F2634 917B08DCE7382B1507AFFD5C1A2E304D222A8E6D4EEEA9CAF55EDAE493CABD41B4C64392D6DF8B23DC2BFFDB9065172EEF1F01F8875F961FE39343365C0F 3B18BB9F72B328A03C81182D354B7115E787A69DC709840A66A37C76C36DDF3E48D1E6168E6AD517606CBD0CD6F36555FC7BC3FF1AB56C8D19588BF989CA 3ADC5487C77B9E27E3C80C004697AD1C6AB869F169F55105C85E7ACBE5B779CFEDFEACAF43170D721009AF118CBCCFFCCBB1022A3D9ECD80BB6C0D1F7B2A 063C3E2B32895E6EB2AD534E8D03EB53E0956FF0165572EEB8550BD8CFB480024C939A0C855935754DB3603C36ADC6FB9697F728A001388B0F9CDF334A66 BC36BC432BEACEA375E5C8F087664310FF62C742A3CACE42CCD4B9C94D27A596F0F665388862AE1690B7427512EE1D50D0049D117E10AE73BBA20DF01AC3 578D94F8184C5B4C8DBA007F76514C84909CDB0FC32ADE854903A16507EFF3F092E8D9488C40955BA41D3314D48B7DBE7DEB54B3EEF25E6D150CA1E009C6 B678FD7D357042C528AB57C3CCE095084E4609DFD4EEC64B091B9C1ACD61367ECD18011E2F082F5537AB12A2211D4F0C645CDE645BF60B620D5CA447A51F DAC3AFD24C3A9CE98FB8A7267C4C Attention! - Attempts of change files by yourself will result in a loose of data. - Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data. - Use any third party software for restoring your data or antivirus solutions will result in a loose of data. - Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data. - If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key.

Emails

[email protected]

Targets

- Target
  
  Medusa.bin.exe
- Size
  
  661KB
- MD5
  
  19ddac9782acd73f66c5fe040e86ddee
- SHA1
  
  24ceba1e2951cde8e41939da21c6ba3030fc531d
- SHA256
  
  dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
- SHA512
  
  e7be7472241fdd26db48dbd0311afe821905f6d59dfb56e3dc035944b7346b0767a8af76d110c5f60c0ba0183ca3791e56d9b3c8b9ba887afa111aafc949c1d4
- SSDEEP
  
  12288:vN3K5e8nbwFigzk6VVMqX8aQNRMcauV9B/rtiPnA40Q8:hCXbwFigzkQVdXvlcayDh49
Score

10^/10

evasion ransomware spyware stealer trojan
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1