medusalocker | 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51[.]sample

Sharing

Copy URL Twitter E-mail

General

Target
51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample
Size 340KB
Sample240227-v8vzvsfe61
SHA256 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
MD5 714870c33ba84e744b84b32e6e114ed9
SHA1 840f442d4466713becdf72b88846871330ac38e7
SHA512 270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2
SSDEEP 6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample

File Explorer

51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample

.exe 340KB

51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.sample

IMPHASH 98834427a5509afe9feea6f9ad5441d9
SHA256 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
MD5 714870c33ba84e744b84b32e6e114ed9
SHA1 840f442d4466713becdf72b88846871330ac38e7
SHA512 270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2
SSDEEP 6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

136225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Education\locker\bin\stub_win_x86_encrypter.pdb

crypt32

CryptStringToBinaryW CryptBinaryToStringW

shlwapi

StrStrIW PathFindExtensionW PathIsUNCW

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmShutdown RmEndSession

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile FindFirstFileExW FindNextFileW WriteFile GetSystemTimes FindClose CreateFileW SetFileAttributesW Sleep GetConsoleWindow lstrcmpiW SetConsoleTitleW MoveFileW SizeofResource GetCurrentProcess AssignProcessToJobObject GetWindowsDirectoryW CreatePipe PeekNamedPipe WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer QueryDosDeviceW InitializeProcThreadAttributeList LocalFree FormatMessageA GetLocaleInfoEx InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RaiseException GetCurrentThreadId IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcAddress QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW WriteConsoleW

user32

GetForegroundWindow RegisterWindowMessageW GetWindowThreadProcessId ShowWindow IsWindowVisible GetAsyncKeyState GetShellWindow

advapi32

CryptGenRandom RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt RegGetValueW CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext RegCloseKey RegCreateKeyExW

shell32

SHEmptyRecycleBinW