medusalocker | b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f[.]sample

Sharing

Copy URL Twitter E-mail

General

Target
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample
Size 335KB
Sample240227-wgnbdafe69
SHA256 b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f
MD5 a286b1e0dc7e26204e9751423ff1e842
SHA1 394e03d3010222b571d1a70bde0233407435bcf1
SHA512 7d6c8f8f829f72b89783598e01baf7b597e459a9c210b6dbd3d8aaaeb3aa93e99e309c9155ef7832bd1ff88d4806448b73744136dc59022fe3ddfaf1d1faa23f
SSDEEP 6144:5Y9zfajnC6iGm15k66Clhdq8yZXlkV68pr2g1PJbmV6Mqu:m9WHm15k66ClHq8yZVypHMqu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample

File Explorer

b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample

.exe 335KB

b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f.sample

IMPHASH e9333030d13d212366770942e0dbc7be
SHA256 b896605b97ae9e2781b21dc5cfb64eec0fc4effa76a7ef33e9cef0b258dff35f
MD5 a286b1e0dc7e26204e9751423ff1e842
SHA1 394e03d3010222b571d1a70bde0233407435bcf1
SHA512 7d6c8f8f829f72b89783598e01baf7b597e459a9c210b6dbd3d8aaaeb3aa93e99e309c9155ef7832bd1ff88d4806448b73744136dc59022fe3ddfaf1d1faa23f
SSDEEP 6144:5Y9zfajnC6iGm15k66Clhdq8yZXlkV68pr2g1PJbmV6Mqu:m9WHm15k66ClHq8yZVypHMqu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Education\locker\bin\stub_win_x86_encrypter.pdb

crypt32

CryptStringToBinaryW CryptBinaryToStringW

shlwapi

StrStrIW PathFindExtensionW PathIsUNCW

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmShutdown RmEndSession

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile CloseThreadpool CreateThreadpool FindFirstFileExW FindNextFileW WriteFile GetSystemTimes FindClose CreateFileW SetThreadpoolThreadMinimum SetFileAttributesW CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers Sleep SetThreadpoolThreadMaximum CreateThreadpoolCleanupGroup SubmitThreadpoolWork GetConsoleWindow lstrcmpiW SetConsoleTitleW GetWindowsDirectoryW CreateThreadpoolWork SizeofResource GetCurrentProcess AssignProcessToJobObject InitializeProcThreadAttributeList CreatePipe PeekNamedPipe WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer QueryDosDeviceW MoveFileW LocalFree FormatMessageA GetLocaleInfoEx RaiseException WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress InitializeConditionVariable WakeConditionVariable QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitializeSRWLock InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW WriteConsoleW

user32

GetForegroundWindow RegisterWindowMessageW GetWindowThreadProcessId ShowWindow IsWindowVisible GetAsyncKeyState GetShellWindow

advapi32

CryptGenRandom RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt RegGetValueW CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext RegCloseKey RegCreateKeyExW

shell32

SHEmptyRecycleBinW