medusalocker | d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae

Sharing

Copy URL Twitter E-mail

General

Target
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
Size 335KB
Sample240101-sf41yschdl
SHA256 d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
MD5 c3d5522f176830c4a24223c96439f668
SHA1 46574cd17ee2a1f2084dc83a65df94e13ce25061
SHA512 0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
SSDEEP 6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae

File Explorer

d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae

.exe 335KB

d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae

IMPHASH 1ea12d4df34c86d29fbe451630dd851f
SHA256 d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
MD5 c3d5522f176830c4a24223c96439f668
SHA1 46574cd17ee2a1f2084dc83a65df94e13ce25061
SHA512 0ed0510f4bba6280e4319f3742d1775d7d251c35517f74f1e2f7350ac68239879b0171a279aab252947163977f363cf3852d52747b225aa160f882cb82bc532b
SSDEEP 6144:1YS9RhUoKV8TCylQ0MWNns5wiSvypQof+9RpfbMPrac6bhMq:1/9T0ylQ0MWNns5xSvyp7W6MMq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CryptStringToBinaryW CryptBinaryToStringW

shlwapi

StrStrIW PathFindExtensionW PathIsUNCW

rstrtmgr

RmGetList RmStartSession RmRegisterResources RmEndSession RmShutdown

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile CloseThreadpool CreateThreadpool FindFirstFileExW FindNextFileW WriteFile GetSystemTimes FindClose CreateFileW SetThreadpoolThreadMinimum SetFileAttributesW CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers Sleep SetThreadpoolThreadMaximum CreateThreadpoolCleanupGroup SubmitThreadpoolWork GetConsoleWindow lstrcmpiW SetConsoleTitleW GetWindowsDirectoryW CreateThreadpoolWork SizeofResource GetCurrentProcess AssignProcessToJobObject InitializeProcThreadAttributeList CreatePipe PeekNamedPipe WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer QueryDosDeviceW MoveFileW LocalFree FormatMessageA GetLocaleInfoEx RaiseException WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress InitializeConditionVariable WakeConditionVariable QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitializeSRWLock InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW WriteConsoleW

user32

GetAsyncKeyState RegisterWindowMessageW IsWindowVisible GetShellWindow ShowWindow GetWindowThreadProcessId

advapi32

CryptGenRandom RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt RegGetValueW CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext RegCloseKey RegCreateKeyExW

shell32

SHEmptyRecycleBinW