General
-
Target
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.zip
-
Size
231KB
-
Sample
230406-1a75eshb6t
-
MD5
6b948ff37a97a8265d828deb12bb4d66
-
SHA1
63f4f6de72684054db8c61c35f4a440d23ef08c0
-
SHA256
125a179c650cc77d612c4b95ba81f89cf2b718e086fec884a71e742d65c8e8d9
-
SHA512
86885c312e17c5034842788e2019509805eea46b776c3c86e09a135681f96ad5581981197f6273f6aba2bc9dab8f1e0bd4b2622918a8b4562cf2a36b6e815a29
-
SSDEEP
6144:yINvXGqNVUGMfizb1ojeG5mxijbUuqxagGUrgSyrDp4p:bNv2qNVWizJojeG5ciAFN5K4p
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">4F23C1F50216113AB19615141866B77E14B33690114863A4636D34BFAFF48C1FD04D964F0B5A23974BC7ED592FBBEEA2E36C46088B7E4264C8EFAF45750B7D6F<br>0B6BBD6ADD488956B2D64F16EDA1DDB5174D1BF706DC5B42658E80B4C459A4C82AA6DAA61A85AF7C3E412EEB6203448BA35F9A9ADF0DD5D2E989391DADDE<br>C536F8193830BB393A5BC7A64082190D80DAE83F713B184BD3AA273CFE9D0C6D0A94585D70A0A8CE78FDDE77780EFD34B9F30D068FBD259D213A4E537C16<br>A13D19EF67D469C8F082083701073098E9183AE4FD1C7E2A1B4F7F5EAB0E5518093A063099CB401F1F32377A6202EFAF654B0541652E6035D881C5520675<br>B74A9A5DBA1ED4483D97B7DC48D124BFA400DDF250B211605099754752137D4A6097EF1FE7AF4A63D1BDFD3C9F9BC03C0C74036DB277F27DFCD4B2E6739F<br>4CBD346742EDB9CE6EDA4750289474FBE347D6E0A3D29F0E7EA82D3EF0371B2203969FD46FBFA5DA648565CBF4FE5A34FD836DD7E4F06C7379D7A6F49520<br>9CCE87B411FAB1245A650C16E2EEB60187D70B4F6C865223CEB4A55BF63D751B57FA676AE1FD865094C46C287B92A609274639F1679B560ABBC1DC009773<br>C7126D6754FD901B1D79A3E8667F984C79B24C711AFD6DD814778E218F5B1459503729DAE86CFEF225DFC0CFE508B5F6CB4CCC6742A5D48DC4C740DDF39E<br>C71737DC887E54F673E080D3B764</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
Family
medusalocker
Ransom Note
Your personal ID:
4F23C1F50216113AB19615141866B77E14B33690114863A4636D34BFAFF48C1FD04D964F0B5A23974BC7ED592FBBEEA2E36C46088B7E4264C8EFAF45750B7D6F
0B6BBD6ADD488956B2D64F16EDA1DDB5174D1BF706DC5B42658E80B4C459A4C82AA6DAA61A85AF7C3E412EEB6203448BA35F9A9ADF0DD5D2E989391DADDE
C536F8193830BB393A5BC7A64082190D80DAE83F713B184BD3AA273CFE9D0C6D0A94585D70A0A8CE78FDDE77780EFD34B9F30D068FBD259D213A4E537C16
A13D19EF67D469C8F082083701073098E9183AE4FD1C7E2A1B4F7F5EAB0E5518093A063099CB401F1F32377A6202EFAF654B0541652E6035D881C5520675
B74A9A5DBA1ED4483D97B7DC48D124BFA400DDF250B211605099754752137D4A6097EF1FE7AF4A63D1BDFD3C9F9BC03C0C74036DB277F27DFCD4B2E6739F
4CBD346742EDB9CE6EDA4750289474FBE347D6E0A3D29F0E7EA82D3EF0371B2203969FD46FBFA5DA648565CBF4FE5A34FD836DD7E4F06C7379D7A6F49520
9CCE87B411FAB1245A650C16E2EEB60187D70B4F6C865223CEB4A55BF63D751B57FA676AE1FD865094C46C287B92A609274639F1679B560ABBC1DC009773
C7126D6754FD901B1D79A3E8667F984C79B24C711AFD6DD814778E218F5B1459503729DAE86CFEF225DFC0CFE508B5F6CB4CCC6742A5D48DC4C740DDF39E
C71737DC887E54F673E080D3B764
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Extracted
Path
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">15E4515ABB000EA2A968F84D80793BEDB812372D9E4A6039B78429FD66437A32809962B231B1D65AA1AF7237D1D9CFA2053F35D8C8F642DF17A684B0A88AAC40<br>94785B88DF40C2542A4D66FB4DC59748296449FD353D56CF79E65CEB1A901A2ED245FE7AACBDFCF7FC9756764ECEBFAED77AC1835517F7B26024D6597B22<br>C5A6F09CE0B7E52A17EF96AF8C168D204F3B7E9D326881AD4D4C6018179F331461B041F335B09CEF1C51F5FE868BE534E56048A677D5791059A3890D5569<br>867E62AD188C08DBE7434E1CEE322E7C60D247DDA3395ADD5993B228825DDFD39F48790A63AF14722D100C993C46DBDCFCA9139827B37CBB7D92054378E0<br>050186A215331868D522A9C9D4754B7B47E511840E531136FB51FF7877C3FC5D59DBAB021BF7E41B8BA823F77AFA632DDE25C183792975C830B86E5835D7<br>859639104F2675E879BB62090957D9F71189D86E5B5C03DF49E3CED2EEF37BA047C5E894C8ADF940149E419F52F5DA9F39EC8EA0F4FC0B380BA111B91930<br>2E724D31BE0C221A535F0D9AEC7D63822C9DC6FC74BC2B35CEB9900F8593E4D05F5B348DF02D7F236B4E7621AA891C3344982A4E3869594951177DA632D4<br>590D50EEA324D88F794D664AF602C09C1AC206DAC03E479D8F6C7DA396D2775377ECAF3AED79DE0E9BC9C2D874FE78408669241E9AA0937634320766221A<br>49883E6302F453CDDA861FFD0239</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Users\Admin\Desktop\HOW_TO_RECOVER_DATA.html
Family
medusalocker
Ransom Note
Your personal ID:
15E4515ABB000EA2A968F84D80793BEDB812372D9E4A6039B78429FD66437A32809962B231B1D65AA1AF7237D1D9CFA2053F35D8C8F642DF17A684B0A88AAC40
94785B88DF40C2542A4D66FB4DC59748296449FD353D56CF79E65CEB1A901A2ED245FE7AACBDFCF7FC9756764ECEBFAED77AC1835517F7B26024D6597B22
C5A6F09CE0B7E52A17EF96AF8C168D204F3B7E9D326881AD4D4C6018179F331461B041F335B09CEF1C51F5FE868BE534E56048A677D5791059A3890D5569
867E62AD188C08DBE7434E1CEE322E7C60D247DDA3395ADD5993B228825DDFD39F48790A63AF14722D100C993C46DBDCFCA9139827B37CBB7D92054378E0
050186A215331868D522A9C9D4754B7B47E511840E531136FB51FF7877C3FC5D59DBAB021BF7E41B8BA823F77AFA632DDE25C183792975C830B86E5835D7
859639104F2675E879BB62090957D9F71189D86E5B5C03DF49E3CED2EEF37BA047C5E894C8ADF940149E419F52F5DA9F39EC8EA0F4FC0B380BA111B91930
2E724D31BE0C221A535F0D9AEC7D63822C9DC6FC74BC2B35CEB9900F8593E4D05F5B348DF02D7F236B4E7621AA891C3344982A4E3869594951177DA632D4
590D50EEA324D88F794D664AF602C09C1AC206DAC03E479D8F6C7DA396D2775377ECAF3AED79DE0E9BC9C2D874FE78408669241E9AA0937634320766221A
49883E6302F453CDDA861FFD0239
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected]
[email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Targets
-
-
Target
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
-
Size
235KB
-
MD5
f6f120d1262b88f79debb5d848ac7db9
-
SHA1
1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
-
SHA256
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
-
SHA512
1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
-
SSDEEP
6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e
Score10/10-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-