Analysis Overview
SHA256
f73508dfaf27c9eaeccf20fde21c0292202ad65bf16c4c0c2285fc4f24f933d6
Threat Level: Known bad
The file 33.out was found to be: Known bad.
Malicious Activity Summary
MedusaLocker
Reads CPU attributes
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-02-23 00:24
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-23 00:24
Reported
2024-02-23 00:31
Platform
ubuntu1804-amd64-20240221-en
Max time kernel
0s
Max time network
179s
Command Line
Signatures
MedusaLocker
Reads CPU attributes
| Description | Indicator | Process | Target |
| File opened for reading | /sys/devices/system/cpu/online | /tmp/33.out | N/A |
Processes
/tmp/33.out
[/tmp/33.out]
/bin/sh
[sh -c rem Kill "SQL"]
/bin/sh
[sh -c taskkill -f -im sqlbrowser.exe]
/bin/sh
[sh -c taskkill -f -im sql writer.exe]
/bin/sh
[sh -c taskkill -f -im sqlserv.exe]
/bin/sh
[sh -c taskkill -f -im msmdsrv.exe]
/bin/sh
[sh -c taskkill -f -im MsDtsSrvr.exe]
/bin/sh
[sh -c taskkill -f -im sqlceip.exe]
/bin/sh
[sh -c taskkill -f -im fdlauncher.exe]
/bin/sh
[sh -c taskkill -f -im Ssms.exe]
/bin/sh
[sh -c taskkill -f -im SQLAGENT.EXE]
/bin/sh
[sh -c taskkill -f -im fdhost.exe]
/bin/sh
[sh -c taskkill -f -im ReportingServicesService.exe]
/bin/sh
[sh -c taskkill -f -im msftesql.exe]
/bin/sh
[sh -c taskkill -f -im pg_ctl.exe]
/bin/sh
[sh -c taskkill -f -impostgres.exe]
/bin/sh
[sh -c net stop MSSQLServerADHelper100]
/bin/sh
[sh -c net stop MSSQL$ISARS]
/bin/sh
[sh -c net stop MSSQL$MSFW]
/bin/sh
[sh -c net stop SQLAgent$ISARS]
/bin/sh
[sh -c net stop SQLAgent$MSFW]
/bin/sh
[sh -c net stop SQLBrowser]
/bin/sh
[sh -c net stop REportServer$ISARS]
/bin/sh
[sh -c net stop SQLWriter]
/bin/sh
[sh -c vssadmin.exe Delete Shadows /All /Quiet]
/bin/sh
[sh -c wbadmin delete backup -keepVersion:0 -quiet]
/bin/sh
[sh -c wbadmin DELETE SYSTEMSTATEBACKUP]
/bin/sh
[sh -c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest]
/bin/sh
[sh -c wmic.exe SHADOWCOPY /nointeractive]
/bin/sh
[sh -c bcdedit.exe /set {default} recoverynabled No]
/bin/sh
[sh -c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 151.101.66.49:443 | tcp | |
| US | 1.1.1.1:53 | dualstack.p2.shared.global.fastly.net | udp |
| US | 1.1.1.1:53 | dualstack.p2.shared.global.fastly.net | udp |
| US | 151.101.194.49:443 | dualstack.p2.shared.global.fastly.net | tcp |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| US | 151.101.1.91:443 | tcp | |
| GB | 89.187.167.9:443 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| US | 91.189.91.48:80 | connectivity-check.ubuntu.com | tcp |
Files
/mnt/How_to_back_files.html
| MD5 | 0cbcb77cc1512f6a7209d03124648adf |
| SHA1 | cfe747222652876333f3a1903f165cdbf940674b |
| SHA256 | e16581fb1611f823c6600bca87a82fb3c2979c22e06215518f5586b795db761f |
| SHA512 | 6fc29bb7c76392b13910fb415af420e3bb8a1c26aa0386cd1ba39ae08309493698e9b83eacb21e4d192da685a552a6c9b53240e956c56d97ef20657027373472 |