medusalocker | 64CO[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
64CO.bin
Size 1.2MB
Sample231129-bf6fcadf37
SHA256 033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c
MD5 a80b79de02d6881d5e54afcefa38298a
SHA1 e0d3e2612a757ff5be818b114028a0e4bb562bc5
SHA512 1fbe52a0086a33a98e48f501c669f3a9e82b5795550702eb61ccc281c77ba29fe217a5897b6caf55582ca1c16d062a2d3219a596d4372c70782bc49499e0ed4f
SSDEEP 24576:FCLKd8jHzb9904e43wa2SZ6Es9S+Nm0m:4K099ReumEwS+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64CO.bin

File Explorer

64CO.bin

.exe 1.2MB

64CO.bin

IMPHASH 4d65c588fc4fed52e2c517152c0f245a
SHA256 033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c
MD5 a80b79de02d6881d5e54afcefa38298a
SHA1 e0d3e2612a757ff5be818b114028a0e4bb562bc5
SHA512 1fbe52a0086a33a98e48f501c669f3a9e82b5795550702eb61ccc281c77ba29fe217a5897b6caf55582ca1c16d062a2d3219a596d4372c70782bc49499e0ed4f
SSDEEP 24576:FCLKd8jHzb9904e43wa2SZ6Es9S+Nm0m:4K099ReumEwS+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

490532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptStringToBinaryA

mpr

WNetGetConnectionW

kernel32

GetCurrentProcess WaitForSingleObject CreateProcessW CreateEventW SetEvent WaitForSingleObjectEx GetLogicalDrives FindNextFileW WaitForMultipleObjects GetQueuedCompletionStatus ResumeThread PostQueuedCompletionStatus GetExitCodeThread TerminateThread CreateThread ExitProcess CreateIoCompletionPort HeapCreate HeapFree HeapLock HeapAlloc HeapDestroy HeapUnlock HeapSize GetEnvironmentVariableW FlushFileBuffers DeleteCriticalSection DeleteFileW FindClose InitializeCriticalSection FindFirstFileW GetComputerNameW OpenMutexW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW GetLastError GetVolumeNameForVolumeMountPointW lstrcpyW CreateMutexW GetModuleFileNameW FindFirstVolumeW MoveFileW CloseHandle SetFileAttributesW CreateFileW SetFilePointer WriteFile GetFileSizeEx ReadFile WriteConsoleW SetEndOfFile Process32FirstW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation SetStdHandle GetFullPathNameW RtlUnwind GetCurrentDirectoryW ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW lstrcatW Process32NextW CreateToolhelp32Snapshot OpenProcess TerminateProcess GetShortPathNameW HeapReAlloc GetConsoleMode MultiByteToWideChar WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx EncodePointer DecodePointer LocalFree CompareStringEx GetCPInfo GetStringTypeW GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleHandleExW GetStdHandle SetFilePointerEx GetConsoleOutputCP

advapi32

RegOpenKeyExW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDecrypt CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenProcessToken StartServiceW OpenServiceW GetTokenInformation GetUserNameW RegCloseKey RegCreateKeyExW RegSetValueExW

shell32

ShellExecuteExW SHEmptyRecycleBinW ShellExecuteW SHGetFolderPathW

oleaut32

VariantClear

rstrtmgr

RmRegisterResources RmStartSession RmShutdown RmEndSession RmGetList

netapi32

NetShareEnum NetApiBufferFree

iphlpapi

IcmpCreateFile GetAdaptersInfo IcmpCloseHandle IcmpSendEcho IcmpSendEcho2 IcmpParseReplies

ws2_32

inet_addr

Name

.text

Size

776KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

227KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

64CO.bin

crypt32

mpr

kernel32

advapi32

shell32

oleaut32

rstrtmgr

netapi32

iphlpapi

ws2_32

generic