General

  • Target

    16292016324.zip

  • Size

    318KB

  • Sample

    240328-nwmdmabf4v

  • MD5

    67234c010fd5e8a3bfd0e7b97bb073b4

  • SHA1

    b54b8529bf6b619d3925e03520d9b15c6d39f8bc

  • SHA256

    36af28c859f4c922bc45b7260e45f0ddcd2ffa7e6002529e567b48ba18c81936

  • SHA512

    f19a4ee61662779d95fe5922231509a4071c2500115af9e9c144927ead30378529aa066a33752c1c3e98413d9be85f45f22fb26315053d3ef08773e7188436aa

  • SSDEEP

    6144:6fALD+s6xqk2soQScgmAmXUpANO4p6jQQyxBAGCrSCh/ZMMmhbLAU9VWKlxq:6aD0qk21mAmkONOWQEBAGkh/65hQUrU

Malware Config

Extracted

Path

F:\!!!READ_ME_MEDUSA!!!.txt

Ransom Note
$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Bimbo Bakeries !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. We have penetrated your entire network and researched all about your data. And we have copied your confidential data and uploaded to several private & cloud storages. 2. We have ENCRYPTED your files. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your sensitive data to the public and send emails to your customers. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues. That will cause a lot of financial loss and damage your famous brand & stock, which will also damage the reputation of DXC technology. After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management of BIMBO or DXC, etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 2 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/3f644030262c44777661abe5ed467ba2 Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( MedusaSupport@cock.li ) Company identification hash: 0bd5c341f1ca5dbee66814e9c4574c84774d0a1364dad8ec246300534db9f166
Emails

MedusaSupport@cock.li

URLs

http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/3f644030262c44777661abe5ed467ba2

Targets

    • Target

      3e19d1653c08206c55e1f835bd890b067b652b99a7b38bad4d78ad7490c6a0f8

    • Size

      622KB

    • MD5

      49b53d3c715ec879efeb51d386b9d923

    • SHA1

      78daa8b99d2fa422926465f36e13f31587b9e142

    • SHA256

      3e19d1653c08206c55e1f835bd890b067b652b99a7b38bad4d78ad7490c6a0f8

    • SHA512

      1a9f0260dc83bd496908da59a643d9889aa26ff8efa1db7468c94272b24943dc9de82c631bf80f76984c4d62324ef6c1429e75942745bfae28eca0a974d5fa75

    • SSDEEP

      12288:/bI6gQJDmr2HPjac75C/YJ+U1B+9UzS9IUW3synhZAgUeevPOEaXBHEdj507nCQp:jnj14lgXDRu6eA7b9OgYgm41PGE0kF

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (8861) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks