Behavioral task
behavioral1
Sample
cc6f5ce9c634e4314eb397f8dd1b144c.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc6f5ce9c634e4314eb397f8dd1b144c.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
cc6f5ce9c634e4314eb397f8dd1b144c
-
Size
5KB
-
MD5
cc6f5ce9c634e4314eb397f8dd1b144c
-
SHA1
45a701855bcb6166ec6b90fc3f37d0c2c2c08957
-
SHA256
5773a66e38797528755069e92c8d7c0f02adab00cf75a9a8d6a82e0f11a534f8
-
SHA512
a4534d3d7f50481a29ae3aa298573ee0465328b2a867b82978f1b4803de58425828d0e2ed8c6de6b491e65844fcc8591c8ee3bdb6b1f24240a63456526010c83
-
SSDEEP
96:8y+cAl5azln+DtZognu+mcCAaUyiKFe8LDmmIj0:8OAl0z8DjX3FaOKYQDm6
Score
10/10
Malware Config
Extracted
Family
medusalocker
Ransom Note
Your personal ID:
0CBA1F44AC25A5465DAA62F5F73B26BC773BCFA2AB306BD2754D522CF0F6287735E7778C06BF8AD75AB538230C2345CB85B9DB147AF14C8C3639FF9A338434DE
B64854F8046A84230068F5513A4BEAD21A6956CBCD4330F176D9A2C8862A4B0434E4B41556CD914D8A864307A293FE6974349B2D6CC1D8DA3BB2F0ED62CD
393CE10EE7C15DEA1839429874414F4764D2AA02670D4FAB224974847F9BFB09AFE6D1AC9D6403E60EF405C651E738E46AE7FA62C5C14284D3929088383D
0697C75AE9F22F8A416BC0D4637253C6F627FD4B51795FCA0EE1E506C2274532CAB1F764596FEF24DBD15F8C8848A5CAE2EC2674C0FB9440A611C040A0E8
91A6749F593FF5AB302CC663AE29672F264FF8D7FB120F0C18BC6EF90E65A97D099440580B53A1FCA35E015142F7D6FDB37ECD45973FD19E0F3264B98BBD
F0722A5CA07054A49996AF4BD2FD115F8E361E1DCB2404D3930CD775077B682508A0B3CB709E78FC6632AEFA083E7293E072293D6B0E3FD09D9ADCF7834C
683C374C0BE3AAD48F1B207C79BFDFA8FD7EBB1F4D9A6F734CAEDAA68EF646864E17B3DD9FD8BBA55C4FA80D54092F2EDAD9DCAB87B23173995F2BB67AFA
FF77B1417022F367CFE5C6F8FFD849D4D8275A56F3BE67A34998ECAA7009CB71BA6C5D31A72F04FB27A9DF700054B4748DEE3041E2CC77DE2E054BF2E1E9
3B80CC6D183AC89C26AB1AFCA654
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
* Note that this server is available via Tor browser only
Follow the instructions to open the link:
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
3. Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
4. Start a chat and follow the further instructions.
If you can not use the above link, use the email:
[email protected] [email protected]
* To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Signatures
-
Medusalocker family
Files
-
cc6f5ce9c634e4314eb397f8dd1b144c.html