General

  • Target

    cc6f5ce9c634e4314eb397f8dd1b144c

  • Size

    5KB

  • Sample

    240315-2kw1ksef42

  • MD5

    cc6f5ce9c634e4314eb397f8dd1b144c

  • SHA1

    45a701855bcb6166ec6b90fc3f37d0c2c2c08957

  • SHA256

    5773a66e38797528755069e92c8d7c0f02adab00cf75a9a8d6a82e0f11a534f8

  • SHA512

    a4534d3d7f50481a29ae3aa298573ee0465328b2a867b82978f1b4803de58425828d0e2ed8c6de6b491e65844fcc8591c8ee3bdb6b1f24240a63456526010c83

  • SSDEEP

    96:8y+cAl5azln+DtZognu+mcCAaUyiKFe8LDmmIj0:8OAl0z8DjX3FaOKYQDm6

Malware Config

Extracted

Family

medusalocker

Ransom Note
Your personal ID: 0CBA1F44AC25A5465DAA62F5F73B26BC773BCFA2AB306BD2754D522CF0F6287735E7778C06BF8AD75AB538230C2345CB85B9DB147AF14C8C3639FF9A338434DE B64854F8046A84230068F5513A4BEAD21A6956CBCD4330F176D9A2C8862A4B0434E4B41556CD914D8A864307A293FE6974349B2D6CC1D8DA3BB2F0ED62CD 393CE10EE7C15DEA1839429874414F4764D2AA02670D4FAB224974847F9BFB09AFE6D1AC9D6403E60EF405C651E738E46AE7FA62C5C14284D3929088383D 0697C75AE9F22F8A416BC0D4637253C6F627FD4B51795FCA0EE1E506C2274532CAB1F764596FEF24DBD15F8C8848A5CAE2EC2674C0FB9440A611C040A0E8 91A6749F593FF5AB302CC663AE29672F264FF8D7FB120F0C18BC6EF90E65A97D099440580B53A1FCA35E015142F7D6FDB37ECD45973FD19E0F3264B98BBD F0722A5CA07054A49996AF4BD2FD115F8E361E1DCB2404D3930CD775077B682508A0B3CB709E78FC6632AEFA083E7293E072293D6B0E3FD09D9ADCF7834C 683C374C0BE3AAD48F1B207C79BFDFA8FD7EBB1F4D9A6F734CAEDAA68EF646864E17B3DD9FD8BBA55C4FA80D54092F2EDAD9DCAB87B23173995F2BB67AFA FF77B1417022F367CFE5C6F8FFD849D4D8275A56F3BE67A34998ECAA7009CB71BA6C5D31A72F04FB27A9DF700054B4748DEE3041E2CC77DE2E054BF2E1E9 3B80CC6D183AC89C26AB1AFCA654 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: ithelp02@decorous.cyou ithelp02@wholeness.business * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Emails

ithelp02@decorous.cyou ithelp02@wholeness.business

Targets

    • Target

      cc6f5ce9c634e4314eb397f8dd1b144c

    • Size

      5KB

    • MD5

      cc6f5ce9c634e4314eb397f8dd1b144c

    • SHA1

      45a701855bcb6166ec6b90fc3f37d0c2c2c08957

    • SHA256

      5773a66e38797528755069e92c8d7c0f02adab00cf75a9a8d6a82e0f11a534f8

    • SHA512

      a4534d3d7f50481a29ae3aa298573ee0465328b2a867b82978f1b4803de58425828d0e2ed8c6de6b491e65844fcc8591c8ee3bdb6b1f24240a63456526010c83

    • SSDEEP

      96:8y+cAl5azln+DtZognu+mcCAaUyiKFe8LDmmIj0:8OAl0z8DjX3FaOKYQDm6

    Score
    1/10

MITRE ATT&CK Matrix ATT&CK v13

Tasks