medusalocker | 1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281[.]exe

General

Target

1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe
Size

669KB
MD5

83904acadd8af410b8271d11b90ee28e
SHA1

f5a8b2f79566ba52f847ce7a57702fe597e24838
SHA256

4bcbae2cffcba5ffd1403eb378527320e266314a734447bfb10d94af9f18ebc5
SHA512

0d5a37fca9de806000d99ca120fa09c9cc84f1849635411de1ecff1ec7ffcc3442fa4b051ebcb4f04eca6c4c8a2c11181e470f04be10702745cba5570630cf9a
SSDEEP

12288:TQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DdI:9uf4wTuV2Ux3uIZeUBi2Te6HW4I

Score

10^/10

medusalocker

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects command variations typically used by ransomware 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

MedusaLocker payload 1 IoCs

Processes:

resource yara_rule

sample family_medusalocker
Medusalocker family
medusalocker

resource	yara_rule
sample	family_medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
1bc0575b3fc6486cb2510dac1ac6ae4889b94a955d3eade53d3ba3a92d133281.exe