medusalocker | f6f120d1262b88f79debb5d848ac7db9[.]bin

General

Target
f6f120d1262b88f79debb5d848ac7db9.bin
Size 231KB
Sample230408-c5ppkade9z
SHA256 f32b419e482fbd17e06913076385025e4def40fce4f7ec56050068e39af5b464
MD5 73454f9baa392bc5242e021b5893331c
SHA1 53e4522fd7bd17cedf8c7d1dc8f93e7e00b0b0d4
SHA512 63f4904bbd441c2c77090f079a6ddcfcde60a8bffef8de45bf15ddc331f284c8a2da23e000a0b121449509da54d2a5039900f700aef3dc31c4f27477c4e43b5e
SSDEEP 6144:fvGMQk/NeUW8uYTEwKdda8VDW5aFvAzJWMJTgEUs:xQk/4FjwErdEuS5qY1W8qs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
static1/unpack002/out.upx	family_medusalocker

Medusalocker family
medusalocker

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe	upx

File Explorer

f6f120d1262b88f79debb5d848ac7db9.bin

.zip 231KB
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe

.exe 235KB
out.upx

.exe 669KB

f6f120d1262b88f79debb5d848ac7db9.bin

SHA256 f32b419e482fbd17e06913076385025e4def40fce4f7ec56050068e39af5b464
MD5 73454f9baa392bc5242e021b5893331c
SHA1 53e4522fd7bd17cedf8c7d1dc8f93e7e00b0b0d4
SHA512 63f4904bbd441c2c77090f079a6ddcfcde60a8bffef8de45bf15ddc331f284c8a2da23e000a0b121449509da54d2a5039900f700aef3dc31c4f27477c4e43b5e
SSDEEP 6144:fvGMQk/NeUW8uYTEwKdda8VDW5aFvAzJWMJTgEUs:xQk/4FjwErdEuS5qY1W8qs
MD5 SHA1 SHA512 SSDEEP

Password

infected

1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe

SHA256 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281
MD5 f6f120d1262b88f79debb5d848ac7db9
SHA1 1339282f9b2d2a41326daf3cf284ec2ae8f0f93c
SHA512 1067c1a73cf891d651fa007f4ccc4452f32801fe3859933ef1bcc00985e35ce016fa6c601c0e3c10df2080fc9b8a776b2f18d40bd64dfb98177ab638c4b545bd
SSDEEP 6144:c5vMUmRTTgwnfeP+Jx1cLNAIyBcc9WrEWUC4wQh/6BeX:/U8Tgufnx1cLNncgQWUUQh/+e
MD5 SHA1 SHA512 SSDEEP

windows x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Password

infected

Minor OS version

Major OS version

Entry point

720752

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 ae00ad8ba6abc6ddac815187f1285cba597d0af8fa4d5ffe429bffb3b6140b5b
MD5 3f002221f0a15187df187cb222d0cb6b
SHA1 0fa815635807c05c2f0e85f0f09362a8e90d1324
SHA512 08bab72bb09b96685f949845858cbaa4f709f7069971ad1f36849cd3f8fde699c1a2d1c0ae5ee397d57057c81c98f6be41c64caaa5e9435d92e10fa1623660d5
SSDEEP 12288:gQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdI:Muf4wTuV2Ux3uIZeUBi2Te6HW4I
MD5 SHA1 SHA512 SSDEEP