L��=_�rv�:э����d)��SlP�n�}Mj�0��������+��pӽx��F��x��d!(��k�J���Ze�M<��m�\��Ѥpڝ�`A"v�ݴ�IS�"O��^̇�RI<��9O����^�z[rq�$`���K�5�A�w��]�s����ۘ�B�-w�Y@ �:��*���z#���s�u�ۯ�7��rW$�x-�9��1��%�6-^3����}��0���1����x �!���8��'�i�[��R���?�2x�+V����xO~@���*7�;�:�/�G��|>�'O(�1��c�^O��?Uw#��+L]����O���cƒ������`0I���8�� Rx���"#ua�����:�5���w�k(��Pļ�Ĕ���M&�w�E�:|�+h �i �31m�X���{��}����&�\����(��]�Z��Pi��">�>��HJ�rA�{ wd�x�D�t�������p��e��n���Ҡ�#��}�eAS:O��U��$�K��*1���}�s����]Z�5��h&j>THS�S�nڋ�G�O�>z�E�C��b��p�����O��LhҢW�ȍk����7��U#\�z+1��%02�T�o�aS��aԽ&�211�nU�]�r\0��[� Z��� ��������EZO�H�4�7���A�Y��þP��5�M/�� ��Q"� ��}ev:�#?�!����0���BmOo�%�U�~��~(���%SU)ˍuڥ�%��\�\@ k���h^@i!�2������Òv9����D���j�c�e!�$�C+���k:�ѻ�'��,�QirYp*&�e��2�L0+йg���,j�A��5`�Z�)����y��V���y@�g;��i���SJv_Lz$��~�5������O*T'E�ʌ�Z�G�� <�J[���3h�Q�%6W%LyHb��\SC�-]�e������w{��͋e�~Sk�z �r��Vh��c@s6tB�w X_/u����6�R�D5R���.�-�B)���=��p�aY�G�D\��hv���t���9q@���B5�����c����l�6/��Nb�����@��i�90,�"��U��6�u�q�iw���9b�v�hs�.�ڗ��(1/s}����aH�?����İU���Y� ��?�]�����5���̀x�F�:�k���"�ߠ��c�Y������6|~�d�BV �+,9�lS�Wo��I��:�`�^0��5^~FJqN<�:2e�zSF�$3�f"���$ʴ����x�C�ۏr%.��SSK���i����p�OJ8���@��<"F�Ř���X�B�E%�(X���a{ƾ����H| ��)H�@j�@1�Ag�v�ٰz/s�lH)���U�t�JL勓`��#�(�4"4V`�,O˖_ ��dG��k�3*�z���G�ǪY�f�i�1���S���N�:k-q�~����"�hg�S�k�9�5������ -���W����������X0���-{h;�T,r_#(��J���j\p���@ɺ�fh���ˍ����z�"��t�N8�����{�y�t����F����GFb.F�t��y��k`�����߈�3:!��.t���9r%F�x����]��X{�c(�����^�� �z��(��R'�fU"��Z �5��a�n�:�L���� Ix'P V�u��dD��X�b*N���N<������{�d�P�zVQ�c[����=�F�H_�J���m�ޖfxC�� ��w~Ј^�x<Q��߾O��=v��\!N�8����V��4�,���%��+cҩ�W�=����3A�!�4��������eI�s��(ڴ�<�o}c�Y_�C��t| SB���.B����!�ЈY��;�\:�<kJ��텄���X�h,Z,U �]ēv�2!,���R����ү��+Y�a����O�I>�viW�@����Vv�kN�y�[���q�Ź�7�A_v6����8CŮ���p�+���e�K� R~�B-�����3�$�j��7o@4��-vROJZe��R��ÒĈ����`��p�vQ9g�2���.D۟8��E�-�72�� ��� D��k휛�ˮ�{��I�a�B���U�g���_������� �<&/�kѥ>�3�3S����<�9Ӫ� \����}>h?r�c�Ŝ�����IQa�Z��y�����v5�.K��d{��f|�y�|)�����ǐו}�H5�s���2��%��|��@0@����,�d��%<�GWe��e����;�3�f�hw� d<�� ������:�`ݱt3���qz�y���wF{�Ep�� �Z ۟g�]hٔ� �wI�Q'��7�R��R�8�n�p6ޥ68p��٤Oj�~H[1��7�m�GF�j�c0��Ed�%x�mV(��ou�Õ�������h��/(@>̰ ���N��iγ5�Zp/_��|X?T\E:���r$�'��hqQ���2���o��zÅqCE�Go��,ǾOkbJ�14uq�Oы�����צ���u��o�5D�c��/ɎZ\7�|���Aɓo5k�?�}=1K�A�_xm���(|G_lT<sI�V�\���֯�'�e|b�F�� �Bҷ�X\|2+�n�o��h�:��R���R�P�h�ay�ՈJ0"��O����z�DM�� �OV� �����=q�y��1f%��V�*.�n&f�vh�mZ퇰�\J�N(���\_�&z ��r(���c�]Y�(�Bd?�u�T�88�U�:�Vc2�ٝ�g��Qw���/v!���a����o��f�'.Ý� �:Vm#�a�Й�v�D��\W�F���0��~��qgl~�)0��Bv8����?�~�2Ur���Gr3R�Tݝ����4�Eq�{���<M�c����� �Z�SX������3'��/���6 ���Fb��_P��s�{q%�HO�Z�d��v�S������^�Ob��'�c���,p�C�6��[�:W �a��q[u�R5���� �j��9h��6V���ɤm����8�
Static task
static1
Behavioral task
behavioral1
Sample
Medusa.uno.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Medusa.uno.exe
Resource
win10v2004-20230220-en
General
-
Target
Medusa.uno.exe
-
Size
5.9MB
-
MD5
9baaab24d9184653127caeeda8c96476
-
SHA1
76c71925859b653370d3c1b6b714af4be5255e64
-
SHA256
6246333cbf0b7a218b0fb86700c7a4e92421ac6587538f8e3c6ec0b8a605626a
-
SHA512
43623be43d15ada3c11d79935ce8e1047c4dba3afe2641d8dfdc44bfae533f5d01b19c5c3b846d76a4e8784345a15173eb913da33d7435b6cae09d8613841de6
-
SSDEEP
98304:cQ2b3IbKNDAGiUXnAYrkL5wsNjui1aKiTEZK4liMilJS4f7d266YRRTUvCjE:crDIbKNDfbAye5wsNjfEKiwZ4lUm7dpG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Medusa.uno.exe
Files
-
Medusa.uno.exe.exe windows x86
0e318cea0452a78c48b60b15aa2d42d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
socket
crypt32
CertGetCertificateContextProperty
advapi32
CryptDestroyHash
kernel32
ConvertThreadToFiber
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
d3d9
Direct3DCreate9
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
RpcStringFreeA
imm32
ImmSetCompositionWindow
xinput1_3
ord4
vcruntime140
wcsstr
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-string-l1-1-0
_strnicmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uno0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.uno1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ