medusalocker

General

Target
14263-Q-CTI.zip
Size 290KB
Sample231106-qmapksch93
SHA256 f1e6e660f0fe1b7e57697661a59c948942688e379b4b4b64274843e8418d18cb
MD5 8921fdfb632901368e1f195d252e5a4c
SHA1 d71b86e7476cd2d6dc34c429b56cad84f1d9c839
SHA512 3295aa3192b0d53064b6ef4e3dcf6d8873414106ad93dd8893642cf68f68088a8bb39cce221d55be3e7091b57ac272233daebdf9af58321fe9255d21b2d2d701
SSDEEP 6144:qG5VsJsr9QHfCtXX0yukfzWb8pcsSjnjMk2ModW1DfnPPwqi/:V81Hf+XgrrsSjnjb2Mo0D3C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW_TO_BACK_FILES.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">93FCFA9BF1985EE846E89AB9CE18246B69B2B0FE9B13FFC88AC488DA9A4D63F790776DA426D4280BEAFFC71CA7FCDAF6B83E8D0650806E93B80AE9EAA45DFB7C<br>27384165F97EF41AD8B79C134BEE012979AD71FCD06998700D34D328512CE0F2114D4277C1A7E84AC20E3CF502F0702E380CD6A182ECCF362DE1D532DF7A<br>DC62E6B9088CAF68B5C3B5AA0A2BBB15AA6E4B10E7AEE8B35BBA9FB31A73D0ED7EDF6C7B8E8798CEEFF449344689C63A0844BBB87C2821EC4E987F6ADCE1<br>A58E8AC147F21128E31BF451E506A3FBBDF9E363B7B968E12A5F6D59045BAEC8EA9B7249EE37BF943707C7AD18F5C907FA5FC32AFE8E663F935151D4A694<br>A578BC15E867AB808CFAF6A6C6596F4277411AB93578861449B36B4948A9174B3122BB0D8DC19FFE64D495281FB9DCE332688AEB3C732DAF76F5535BE910<br>4F7DE3D928DE10E060224C0C2D4F7FA6FC7FF1F152621260DDB025673E8D86600A9CCA95E064826F6401BD6967D86AA4E626FB2989291651FCD210AE3C90<br>F2C95577C873C2E933DB77F7556BA4936952B9711DB63D017DDEA7F7AC0F8EF87A89A4375ADAAF0681F90050A55E7F61C9337292141AB8A1ACEE91FA43C0<br>30998DCED09470C03960171A86BE9AC257FE5B9874D3391A9F4455AA1FB1DE1DBC37AD34521E952B24EAF129DCD25837C0CAE37CB90522EA9A07316962BC<br>FDAEF18D9DC5DBBCCD8A3824672D</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> * <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html> {{URL}}

Emails

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_BACK_FILES.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">0FF3D6A6F2F6234E762F75ED2FB923F039A3E55F91F207F8BF7779DE13D16659E82EE931D69B208808C2B3F1B5D335247EBD54A7E98DABB5C1128DA8185EFBA1<br>C99313E037455B44E235F755AFC35F9E44F175250F1400BBA3AC91D451C72A577082FA0F795CF032DDFAC39830A3AA8D47CF9BCC44DF74287157245BE673<br>DE1E9D265B4816FCA69970AB768BCF9544FE92CBCF7F78AD3661E577B0A6505AF3B027889C4404B55DEB51A83AB5D1F3064C72D40C9AC22D40EECA3189A6<br>9195F5B861E2483479E6E89F680B76E8971709EA03AEA42611E349A612791582D94B93A957CD0A3ED46C10AD0E0E443AB82C092D9815C25F76F832A0984C<br>C4DA29C77C60010BDC03DC8B24B7354C72AD966EFFFA4DBF178AF5A77B07EFA3478EA31C97F34246572FCB827DE56CBFA703124D301898B092633B32DB22<br>A9507BB3C61EC4C934CE44A13CB87B40459FF9ADAE62A82D29339FFE570D666FCDFD581FA7036168B36D56D2A6F1F70E944E522D796E91450088403D91F3<br>01E92BB3A8B68DEC2EF89DBD4058DF056B1B641CAE064C30A18406FF80731712102C11268E16D6EDDEA4AAA885B14257ABCD83C323CDEEA1ABCD33C6B42A<br>56A63FB8629F7A911CCA7934862D079BAC731CB09164C15CECC7B0401431327AF55ED6AE5E04E75D6CB104C6B0D1A8D7B857DAFF74378D468866EB5AC671<br>872BADAECB9C3D113390CA3DB216</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> * <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html> {{URL}}

Emails

Targets

- Target
  14263-Q-CTI.exe
- Size 669KB
- SHA256 3964c77cba25aa842d89dc9a6ac1c50c473fec97f0f798d8fb815d76dd1257cf
- MD5 ca74bacf835fc1effa36a5c7966c18b5
- SHA1 cd2ca5370811e30999225d15d0eaebbc889db513
- SHA512 aab1de901b5a5a47e9ba91bf99483462e3e765ab610346d1a8582fe3d5a432dbedaf80c23a4752a6e6de13db4e5913b2e89073cdcb610d26e1f0fb7ad052d872
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DOKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWHKrKe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (218) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (307) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2