medusalocker | 14263-Q-CTI[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
14263-Q-CTI.zip
Size 290KB
Sample231106-qmapksch93
SHA256 f1e6e660f0fe1b7e57697661a59c948942688e379b4b4b64274843e8418d18cb
MD5 8921fdfb632901368e1f195d252e5a4c
SHA1 d71b86e7476cd2d6dc34c429b56cad84f1d9c839
SHA512 3295aa3192b0d53064b6ef4e3dcf6d8873414106ad93dd8893642cf68f68088a8bb39cce221d55be3e7091b57ac272233daebdf9af58321fe9255d21b2d2d701
SSDEEP 6144:qG5VsJsr9QHfCtXX0yukfzWb8pcsSjnjMk2ModW1DfnPPwqi/:V81Hf+XgrrsSjnjb2Mo0D3C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
static1/unpack001/14263-Q-CTI.exe	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/14263-Q-CTI.exe

File Explorer

14263-Q-CTI.zip

.zip 290KB
14263-Q-CTI.exe

.exe 669KB

14263-Q-CTI.zip

SHA256 f1e6e660f0fe1b7e57697661a59c948942688e379b4b4b64274843e8418d18cb
MD5 8921fdfb632901368e1f195d252e5a4c
SHA1 d71b86e7476cd2d6dc34c429b56cad84f1d9c839
SHA512 3295aa3192b0d53064b6ef4e3dcf6d8873414106ad93dd8893642cf68f68088a8bb39cce221d55be3e7091b57ac272233daebdf9af58321fe9255d21b2d2d701
SSDEEP 6144:qG5VsJsr9QHfCtXX0yukfzWb8pcsSjnjMk2ModW1DfnPPwqi/:V81Hf+XgrrsSjnjb2Mo0D3C
MD5 SHA1 SHA512 SSDEEP

Password

infected

14263-Q-CTI.exe

IMPHASH 1a395bd10b20c116b11c2db5ee44c225
SHA256 3964c77cba25aa842d89dc9a6ac1c50c473fec97f0f798d8fb815d76dd1257cf
MD5 ca74bacf835fc1effa36a5c7966c18b5
SHA1 cd2ca5370811e30999225d15d0eaebbc889db513
SHA512 aab1de901b5a5a47e9ba91bf99483462e3e765ab610346d1a8582fe3d5a432dbedaf80c23a4752a6e6de13db4e5913b2e89073cdcb610d26e1f0fb7ad052d872
SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DOKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWHKrKe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

238375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32NextW Process32FirstW CreateProcessW GetTickCount CopyFileW GetCurrentProcess WriteConsoleW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject TerminateProcess FindClose FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW FindFirstVolumeW QueryDosDeviceW GetEnvironmentVariableW GetLogicalDrives GetProcessHeap MoveFileExW SetFilePointerEx HeapAlloc CloseHandle GetLastError SetFileAttributesW GetFileAttributesW CreateFileW WriteFile HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetFileType GetTimeZoneInformation EnumSystemLocalesW HeapFree GetFileSizeEx GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetStdHandle ReadFile OpenMutexW Sleep CreateMutexW GetModuleFileNameW SetEnvironmentVariableW EncodePointer DecodePointer RaiseException GetCurrentThreadId IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW WideCharToMultiByte MultiByteToWideChar FindFirstFileExW FindNextFileW GetFileAttributesExW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WaitForSingleObjectEx GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitProcess

advapi32

CryptExportKey RegCreateKeyW RegOpenKeyExW RegSetValueExW RegCloseKey CryptReleaseContext CryptGenKey CryptImportKey OpenProcessToken GetTokenInformation CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW OpenServiceW QueryServiceStatusEx CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey RegDeleteValueW

shell32

SHEmptyRecycleBinW

ole32

CLSIDFromString IIDFromString CoInitializeEx CoGetObject CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

SysAllocStringByteLen VariantClear SysAllocString SysStringByteLen VariantInit SysFreeString

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetShareEnum

iphlpapi

IcmpSendEcho IcmpCloseHandle GetAdaptersInfo IcmpCreateFile

ws2_32

inet_addr

rstrtmgr

RmShutdown RmRegisterResources RmStartSession RmGetList RmEndSession