medusalocker | 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e[.]sample

Sharing

Copy URL Twitter E-mail

General

Target
0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.sample
Size 277KB
Sample240227-v4j2ssfd2w
SHA256 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e
MD5 1ba9aa5710b0bf3e271329994311d4a0
SHA1 d6fbad1833aa5285de18e425af58bc3420722c4b
SHA512 8f81ddf7c6ab01fe04a04daec1bb9af87ed3cb9cc195d8628c7f5a896aff38f798d00499b9110761cfedada42e3a23c818516c17243aad081590bd0831f6ac71
SSDEEP 6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdTNN4:6l4qnM6c26s39UNN4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.sample

File Explorer

0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.sample

.exe 277KB

0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e.sample

IMPHASH 979e883220a6bc4d790e8029de6a2531
SHA256 0597302ff00b1d3cfc79e81952955d852a62e76929348bb279ccdafae1ca010e
MD5 1ba9aa5710b0bf3e271329994311d4a0
SHA1 d6fbad1833aa5285de18e425af58bc3420722c4b
SHA512 8f81ddf7c6ab01fe04a04daec1bb9af87ed3cb9cc195d8628c7f5a896aff38f798d00499b9110761cfedada42e3a23c818516c17243aad081590bd0831f6ac71
SSDEEP 6144:6Z1gm4z+Rp4PCL8YM6c2G/FtmUPvo39UPdTNN4:6l4qnM6c26s39UNN4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Education\locker\bin\stub_win_x86_decrypter.pdb

crypt32

CryptStringToBinaryW

shlwapi

PathIsUNCW PathFindExtensionW StrStrIW

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile QueryThreadpoolStackInformation CloseThreadpool FindFirstFileExW FindNextFileW WriteFile SetEndOfFile FindClose CreateFileW CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers SetFilePointerEx GetConsoleWindow lstrcmpiW SetConsoleTitleW GetWindowsDirectoryW SizeofResource GetCurrentProcess InitializeProcThreadAttributeList WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer QueryDosDeviceW MoveFileW LocalFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW WriteConsoleW

user32

GetWindowThreadProcessId GetAsyncKeyState RegisterWindowMessageW ShowWindow IsWindowVisible GetShellWindow

advapi32

RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptDecrypt CryptImportKey CryptReleaseContext RegCloseKey RegCreateKeyExW