medusalocker | cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9[.]sample

Sharing

Copy URL Twitter E-mail

General

Target
cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample
Size 332KB
Sample240227-wj4fdaff34
SHA256 cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9
MD5 10c5fde0d48f9058490705ce7646d73b
SHA1 204eaa05dd25c6d71cef19b16c0cd232b05e1ae8
SHA512 7d37506597ca2e8bf624d0c6fca592e72e436fe4b906ac6334a4ff6b57f363834bf35f1038209e6bf67d43b39f538b7ebdd72a2b268dd1297bf6c99728e48854
SSDEEP 6144:Sq9ezqsEC8dS7CCKUf+9xwL1ZTcDCzyrxQX3hVds+tfCOu3miq/RiXq:S4JsE3CKUf+9xwL15cDCzie1ChhXq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

medusalocker

Malware Config

Signatures

MedusaLocker payload 1 IoCs

resource	yara_rule
sample	family_medusalocker

Medusalocker family
medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample

File Explorer

cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample

.exe 332KB

cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9.sample

IMPHASH 5bf936bebe28f8480c668b86291f79fc
SHA256 cf3b068448640298738c2a407427335a289832d0c0013fda10e0fceceb208cd9
MD5 10c5fde0d48f9058490705ce7646d73b
SHA1 204eaa05dd25c6d71cef19b16c0cd232b05e1ae8
SHA512 7d37506597ca2e8bf624d0c6fca592e72e436fe4b906ac6334a4ff6b57f363834bf35f1038209e6bf67d43b39f538b7ebdd72a2b268dd1297bf6c99728e48854
SSDEEP 6144:Sq9ezqsEC8dS7CCKUf+9xwL1ZTcDCzyrxQX3hVds+tfCOu3miq/RiXq:S4JsE3CKUf+9xwL15cDCzie1ChhXq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

MedusaLocker payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Education\locker\bin\stub_win_x86_encrypter.pdb

crypt32

CryptStringToBinaryW CryptBinaryToStringW

shlwapi

StrStrIW PathFindExtensionW PathIsUNCW

rstrtmgr

RmGetList RmStartSession RmRegisterResources RmEndSession RmShutdown

mpr

WNetGetConnectionW WNetAddConnection2W

kernel32

GetLogicalDrives FindFirstVolumeW SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW DeleteVolumeMountPointW FindNextVolumeW GetDriveTypeW ReadFile QueryThreadpoolStackInformation CloseThreadpool CreateThreadpool FindFirstFileExW FindNextFileW WriteFile FindClose CreateFileW SetThreadpoolThreadMinimum SetFileAttributesW CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers SetThreadpoolThreadMaximum CreateThreadpoolCleanupGroup SubmitThreadpoolWork GetConsoleWindow lstrcmpiW SetConsoleTitleW GetWindowsDirectoryW CreateThreadpoolWork SizeofResource GetCurrentProcess AssignProcessToJobObject InitializeProcThreadAttributeList CreatePipe PeekNamedPipe WaitForSingleObject OpenProcess MultiByteToWideChar UpdateProcThreadAttribute LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetExitCodeProcess CloseHandle GetLastError CreateJobObjectW SetInformationJobObject FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc DecodePointer QueryDosDeviceW MoveFileW LocalFree FormatMessageA GetLocaleInfoEx RaiseException WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CloseThreadpoolWork GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress InitializeConditionVariable WakeConditionVariable QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitializeSRWLock InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwind SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW WriteConsoleW

user32

GetAsyncKeyState RegisterWindowMessageW IsWindowVisible GetShellWindow ShowWindow GetWindowThreadProcessId

advapi32

CryptGenRandom RegSetValueExW OpenProcessToken GetTokenInformation CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt RegGetValueW CryptExportKey CryptImportKey CryptGenKey CryptReleaseContext RegCloseKey RegCreateKeyExW

shell32

SHEmptyRecycleBinW