medusalocker | 96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a[.]sample

Sharing

Copy URL Twitter E-mail

General

Target
96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a.sample
Size 333KB
Sample240227-wdsfxsfd78
SHA256 96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a
MD5 57504bca0f333befa73476e449f6a8a0
SHA1 c207f136cda100bb9b319d3276914f697ccb3499
SHA512 cfe9f07fadbf874b9694990c631c8562ad511bbedd7ea91451d80a5c934f4c1036596b0043e441d3078a37cfef6bba818264ef64044606d77657e7a4a0c29bfc
SSDEEP 6144:AemY9cZrt2pF+M9htFl/1M0lpj9G/OaZE8A8otk1:n9cm+M9vFl/1HrN2otk1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a.sample

File Explorer

96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a.sample

.exe 333KB

96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a.sample

IMPHASH f22bc6a616927c119c37738048bc1cc5
SHA256 96a1e457593890cfc5535daa37eac9aef9f18442608ee7c14fb2f1ba472b626a
MD5 57504bca0f333befa73476e449f6a8a0
SHA1 c207f136cda100bb9b319d3276914f697ccb3499
SHA512 cfe9f07fadbf874b9694990c631c8562ad511bbedd7ea91451d80a5c934f4c1036596b0043e441d3078a37cfef6bba818264ef64044606d77657e7a4a0c29bfc
SSDEEP 6144:AemY9cZrt2pF+M9htFl/1M0lpj9G/OaZE8A8otk1:n9cm+M9vFl/1HrN2otk1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Education\locker\bin\stub_win_x86_encrypter.pdb

crypt32

CryptStringToBinaryW CryptBinaryToStringW

shlwapi

StrStrIW PathIsUNCW PathFindExtensionW

rstrtmgr

RmShutdown RmGetList RmRegisterResources RmEndSession RmStartSession

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile FindFirstFileExW FindNextFileW WriteFile FindClose CreateFileW SetFileAttributesW SubmitThreadpoolWork SetFilePointerEx GetConsoleWindow lstrcmpiW GetWindowsDirectoryW SetConsoleTitleW MoveFileW CreateThreadpoolWork SizeofResource GetCurrentProcess AssignProcessToJobObject InitializeProcThreadAttributeList CreatePipe PeekNamedPipe WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer WriteConsoleW QueryDosDeviceW LocalFree FormatMessageA GetLocaleInfoEx RaiseException WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress InitializeConditionVariable WakeConditionVariable QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitializeSRWLock InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW

user32

IsWindowVisible ShowWindow GetWindowThreadProcessId RegisterWindowMessageW GetShellWindow GetAsyncKeyState

advapi32

CryptGenRandom RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt RegGetValueW CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext RegCloseKey RegCreateKeyExW

shell32

SHEmptyRecycleBinW

ole32

CoGetObjectContext CoGetApartmentType