Overview

overview

10

Static

static

10

medusa.exe

windows10-2004-x64

10

Resubmissions

11-04-2024 18:57

240411-xl1ypsdc9v 10

28-03-2023 10:46

230328-mve3gscb91 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    medusa.exe

  • Size

    669KB

  • Sample

    230328-mve3gscb91

  • MD5

    646698572afbbf24f50ec5681feb2db7

  • SHA1

    70530bc23bad38e6aee66cbb2c2f58a96a18fb79

  • SHA256

    26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

  • SHA512

    89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a

  • SSDEEP

    12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe

Score
10/10
medusalockerevasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">B42D2CAA662AC0F205F8511F54784B4F3F3948D613C2F0B769C273B8E58325A82AFE7887DCC94DF3D98B4D7CFFAFEB775CAFA8DA2FA4FFC44139CE54043D6A7F<br>099EB88563583ADEC64599734824FF42D4FA8A757DD5F14E2A6EA78FF14FC5F50D9F38FAB1FFBF4E7C96C7C57507C06E31568670DCD43EB5626DD2535B96<br>375F1AF08DD392FE6D3E673CFA8AAF89EC9E44F8B2B9E997A4321AA0CF4261B7D1AE7C97E030587AA1EE9A73B88E23B2304B058951DB72B6629009DC60C9<br>74F210CD039A7C5DB762DB380044533470A495BAACAAB7EACC0B20A150574705E42077C8636313B17F9CF17D6F6303C913669E4154753BFAF34C4ABB8D62<br>D910FE7A1C30CB781BFFF6F580D17E239F50FDB934B97994E70C55F13FBF3BDB8D1ACC378CC918E294866DA4EA43C15E946F2DC3EE1D11DC44B69E2DF4A7<br>FE4CEB1694FCD33BD6D67D638C990AFD4583C3902DD91024C39E92C01BE64D3A33EBC5599740DE3346E7F42C19A9451A6A671629614F84D6C19C68F3F981<br>25F585B070735062F41A578A5B21E688F1D1AA22D7BB1E0D47F7944A65217A6EC19A7826DC21B83FDF2E9649FD8054D5570C3ECC08B3C35B37AF0170E841<br>8021677C4F2979D2523F04609C522B4E5B5DEA7287DA615F038757F3E018A880697B6A7D20514BF50FD1BF313BAD70CB2C5D93A54A68E055EF1F92B32149<br>C184F7C14707D136F1A01111B10A</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="ithelp02@decorous.cyou ">ithelp02@decorous.cyou </a> <br> <a href="ithelp02@wholeness.business ">ithelp02@wholeness.business </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>
Emails

href="ithelp02@decorous.cyou

">ithelp02@decorous.cyou

href="ithelp02@wholeness.business

">ithelp02@wholeness.business

Extracted

Path

C:\Users\Public\Desktop\how_to_back_files.html

Family

medusalocker

Ransom Note
Your personal ID: B42D2CAA662AC0F205F8511F54784B4F3F3948D613C2F0B769C273B8E58325A82AFE7887DCC94DF3D98B4D7CFFAFEB775CAFA8DA2FA4FFC44139CE54043D6A7F 099EB88563583ADEC64599734824FF42D4FA8A757DD5F14E2A6EA78FF14FC5F50D9F38FAB1FFBF4E7C96C7C57507C06E31568670DCD43EB5626DD2535B96 375F1AF08DD392FE6D3E673CFA8AAF89EC9E44F8B2B9E997A4321AA0CF4261B7D1AE7C97E030587AA1EE9A73B88E23B2304B058951DB72B6629009DC60C9 74F210CD039A7C5DB762DB380044533470A495BAACAAB7EACC0B20A150574705E42077C8636313B17F9CF17D6F6303C913669E4154753BFAF34C4ABB8D62 D910FE7A1C30CB781BFFF6F580D17E239F50FDB934B97994E70C55F13FBF3BDB8D1ACC378CC918E294866DA4EA43C15E946F2DC3EE1D11DC44B69E2DF4A7 FE4CEB1694FCD33BD6D67D638C990AFD4583C3902DD91024C39E92C01BE64D3A33EBC5599740DE3346E7F42C19A9451A6A671629614F84D6C19C68F3F981 25F585B070735062F41A578A5B21E688F1D1AA22D7BB1E0D47F7944A65217A6EC19A7826DC21B83FDF2E9649FD8054D5570C3ECC08B3C35B37AF0170E841 8021677C4F2979D2523F04609C522B4E5B5DEA7287DA615F038757F3E018A880697B6A7D20514BF50FD1BF313BAD70CB2C5D93A54A68E055EF1F92B32149 C184F7C14707D136F1A01111B10A /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Emails

ithelp02@decorous.cyou

ithelp02@wholeness.business

Targets

    • Target

      medusa.exe

    • Size

      669KB

    • MD5

      646698572afbbf24f50ec5681feb2db7

    • SHA1

      70530bc23bad38e6aee66cbb2c2f58a96a18fb79

    • SHA256

      26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0

    • SHA512

      89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a

    • SSDEEP

      12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe

    Score
    10/10
    medusalockerevasionransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • UAC bypass

      evasiontrojan

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks