medusalocker

General

Target
4ef811b784b985769645e03bc0b9cd24
Size 669KB
Sample240109-xrn64aaae6
SHA256 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c
MD5 4ef811b784b985769645e03bc0b9cd24
SHA1 2e04a37b215dd2a95694b1c18dbe1dd35be5aa9f
SHA512 34e9a5a015b04ae904b50a0b2e466788db16d7eb43769fec156cab830932032174b3a43a206016332f99eb16571225dc1a0a0042ce2bca67de1821bbc08c039c
SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DBKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWUKrKe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">4CB884E686C4A903E35C87018D2AD8E56D647C4CEDAE3224B8933CF79437DDCCCDFC6CFE8ED6F5721F6C949394A6877C9F5DE74088C4199804C6B233C9AF7ED3<br>5A330BAD8D5E2D6041B3781968F3AA92CFAC63DDA2A0F8DB1F5A1CE8F31E281181EE9396AC86E3CE9C596DD643344A355E22BD6ACCB03514D6DBA924266A<br>55C83017BFF40EBEBDB6253322C90085EF7A77CD31FE4EC46E9B952E8227AE34ED729C79A87D7D5673DD7070EA237FC9379F9E8EE46FE9FECA7BC665CE65<br>D147F803537D3D715649E127E67FE233A9FAC1175B7CDACE862C0A01B348002144B2E8F065D367682CD67424ED74E6C7555552F387ED392C432FC7066250<br>80BC9448A949D680EC77404481842B2FEAB75C7469004B816CAFB6976F46F0767CE599997E60216F1897B93E5E7B29D3425232FD6223D2B32272528AA799<br>8BDC052CB4079485FD0135AE911C8AF534A75C9C004468DC04BBA9C5DC4DC387BE7EB238A8523F21D3B9C59DD9F81675B5CE6595AE83A2D3AEDC62F7936B<br>C29F98E319771F5F4C9C085241524B326D1C3FD16E7521DD2904C5A8BBD2468693FBABEB2B1DD903426DCC3AA4C118E34967B24F36969A007615BAF39AE7<br>E8BCD0C675989CBFE73342637829DF5CA6C0BCC75C2D911AAAEA21EADBC6CB1A506AFE7779143950374941803C728710890E6294A9FA0CD6A62DE25C870B<br>8A7216F13F8FFBE86CCE6B5C224C</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]
">[email protected]
href="[email protected]">[email protected]</a>

Targets

- Target
  4ef811b784b985769645e03bc0b9cd24
- Size 669KB
- SHA256 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c
- MD5 4ef811b784b985769645e03bc0b9cd24
- SHA1 2e04a37b215dd2a95694b1c18dbe1dd35be5aa9f
- SHA512 34e9a5a015b04ae904b50a0b2e466788db16d7eb43769fec156cab830932032174b3a43a206016332f99eb16571225dc1a0a0042ce2bca67de1821bbc08c039c
- SSDEEP 12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DBKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWUKrKe
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (283) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2