medusalocker

General

Target

9629508334.zip
Size

170KB
Sample

230320-z5w5zafd79
MD5

e6109b8b50d65f97a94697a02d48465c
SHA1

f2870941a37add1662a118d3a99fab0d7ff126f8
SHA256

4af89ff4b3a8783226e1d38bf7e8eea6cd135e9708b214273e6d41d024f1970f
SHA512

4f912289a561003c10508ebeaa324a420d7e1c27f92304ee3316cdb9f9cf69c95c92bde252e3ae817daca38d1593bbc97bed64606be35f7d0235492340fd8cd9
SSDEEP

3072:VFf2+0KmcneijvG6fnCtywpocf4BU6fFXS/ffKF5Ff+rBI9/OYFYhrnuPQgffKZ3:r2+0cndzGIny4UuSnfGFf+ruFLYgPjS3

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Desktop\How_to_back_files.html

Family

medusalocker

Ransom Note

Your personal ID: r5egxq3EsF8f/Y8td49NJT8JLrjsjUQdrsatGpFBIvYKhbwhbaZJStUHV5FTg/nOWZWtyKWVUNUUNuMeITxn615u1fDciAVFxRhSSApJV0GUZitNZNfbzOtEQiEpxkJ/QAzdn7TiOstk9gJQYiB5MR1lJZ1MRUMXEeEdyJMvZhvB0RcxZOOxK3EsQJyU1HzFsZtG7aspDUVLAi19Ogx9LHKARWvNMZNiZgbXLBPvrNjoaDFKkYl8ETb0/HcUrD+EnoflGMKG+/cPl4gHaFCfqxtMgPH3TCN5pV67Nhqx1qkp0GujsvCeRAX1FGZwWJwuiWabYDG5PopvEng7mGgs3k1cJT6fFuCNoPN4D7/JlwfAQcpruROaU8qet/1y2xKEv/pctDEyPY7/ftybmSUCAdNX6QJTln6h/FAVyAxpCuUm1fFl0KhtzBWhN0TYYZYz9wkLA8uL1dVMf7lntM2HAwsNDNOuQ/tIZmWT1WUnXwox6gxC4GCW71sYFzO0ZFRo5q7V3IaIzuQxzFrmRjfHu90Tg7yDjg1Y0Jve9LeJTPGqVuXd4uRR9VAuzbfEwcL4pULq8yFjkfZfdtponV4Pld3UHysQCkF0EbswssLMr7u0IIE2vCN7zIvYOrqJ8FtxE1ChDhMz/XwKNHOhCdEr77pJUTqhtu5JAQjW6UcEcBAp/ESJaJrvp1TOXU35Fi0PkrXXU78ORFuDBLuh3w03L/SOaEViAVGIlianP2DEOsi6u/Y+3eAZeQiPsv//ag51XThnXX3H+D06hAs1Ne2I/eeif8izq/U3dOBtXnProrgU7Tyo/CCIDrz+5HenLfrrJqw0sy7tgOu+iOHh104sVhbwJF9TyJzvoDdX423T3fF2TPRsQQJvYIBR1zwqO0gN7svpn+CIJbuaUlxMdYY4zOdqoc9+OdJpfQtfMVTFtVqZYaZR4mgve6ziUWpBKhtfUv+ThGS5/fiphLrn9qSu3DpbH8jWjBz/Qujz+aaDmaSNlNeiywvhCaD+37YKpmItxD9wM1KlmN0ABVKY8gt5HQneosSQXOYqXLbUA4jlQo++uomwAZzKTGxFFeqQqzmc8nwNll4CtkISkQj4N5V8F8UzBYfcr9G47iu8oWBOFtk/aFjKZS/lBdQqQNWPmUV51xIndJRmygzcrv/UByY5sa4RKZ1BJSGGFqPc//Ay+ZM20Bh8Az+aGN7dhzmVbZ6HyMvalNSGKtUttvVrOnizDwg+hngngvRGAYPqQiQx4GQfvZaiSOq7l+RrkurZdr/3kIzinulMtnv1L+HnuhU9n838nntjVPwLTsYE6OMt17ryeQjb4Rlonk5UpotKiWMOvQNhJdF7QW1shlkKBl0plRRSgRYpxm+cZT0eoGP/lSUTcXFcjCkKxfyj/WJYYGcjjiRX5ulTQLlZzgWmpY3P9WKJ8AJam0BTbGMmVt4t0okUkApL6FmOVg7/OO4NjCZDvtVXTzdPEc+DlglqUxQry8qsTeIQVzj5IrJj9YEB/BM2toZav9q2WrN2YVW5W7FFPuId/ARPhpM3i4RDGHxpeBl6Z56zzmfDp1BmRgzBPVTTUNoA3UNqoMxiEf5ifEuOaJ1/lPf/wjI38QmXunJflTCXAxlHdftFokqyhHzcV29mF27P92rjaQ+EZULIYN3W8qN7Es9QnfwPJeOkT+6+7AMLUXJCXSTHrxchZAvH9Os= /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. If you can not use the above link, use the email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

[email protected]

Targets

- Target
  
  db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0
- Size
  
  332KB
- MD5
  
  315ba41e7afd432a90b91ecca8785606
- SHA1
  
  700b771bb556457b39e3b021aea3386297c17328
- SHA256
  
  db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0
- SHA512
  
  d22a4936631118a675e988caa5a4f6b8fd99a113abb02c73da9dd5a67f6a20285a68ab90acce961c312492c03a9743bfc2d36959cf10ad18f6d562c893ae8d2f
- SSDEEP
  
  6144:SSu95CM96x7SQmTY3q1af/eP0J8j9HvJpktPV1Hni+oA7SCtkW:M9IM9wmTY3Uaf/eMGFWhbtkW
Score

10^/10

medusalocker evasion persistence ransomware
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes system backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2