General

  • Target

    16235419622.zip

  • Size

    318KB

  • Sample

    240328-nwqfaahc98

  • MD5

    4d23b3ebdb4ae3a2fee0836781a3560c

  • SHA1

    a883b69bf669ae47a0009eb262f2e72cb331cad6

  • SHA256

    131e8818ae951f6ddb346c59f06ed0573b74861964e071bbfd370b876097f5db

  • SHA512

    8841a19ee286e415e48a813517025e8c0a819c135c22f0f5824def66a1c3d57933ee8b114bf86067d09643e07a51fe52a5011420c051d158bd5dad23aca1eb4a

  • SSDEEP

    6144:4Cmz+wP/tdi/+nV+eROxByVohpJqoiYuFZ93Y8vttQxPnVpWfEiYY:4Tyy/XnV+9xByVITqo+FZ97vttQx9pW3

Malware Config

Extracted

Path

F:\!!!READ_ME_MEDUSA!!!.txt

Ransom Note
$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, Glendale Unified School District !!! ]-------------------------- Sorry to interrupt your busy business. WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. * We have penetrated your entire network for several months and researched all about your data. * And finally, we have copied all of your confidential data and uploaded to several private & cloud storages. 2. We have ENCRYPTED your files. We mainly focus on data exfiltration but we also encrypt some of your files too. While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware. Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post all of your sensitive data to the public and send emails to your customers. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us. https://www.the74million.org/article/from-campus-rape-cases-to-child-abuse-reports-worst-case-data-breach-rocks-mn-schools/ You can suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. After paying for the data breach and decryption, we guarantee that your data will never be leaked and this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management, etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 3 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/291b071d62bd319d16df0b898c6cbf90 Or Use Tox Chat Program(https://utox.org/uTox_win64.exe) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( mds.svt.mir2@protonmail.com ) Company identification hash: 6c93c3147f9d47e4e2292869cd2e17a492ade325b8de488a8fd904d426fa5578
Emails

mds.svt.mir2@protonmail.com

URLs

https://www.the74million.org/article/from-campus-rape-cases-to-child-abuse-reports-worst-case-data-breach-rocks-mn-schools/

http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/291b071d62bd319d16df0b898c6cbf90

Targets

    • Target

      3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6

    • Size

      623KB

    • MD5

      04581fa15276f0d55108ed58dceac710

    • SHA1

      8b185c6b6f2cac6325f219612bddb7b0011caab4

    • SHA256

      3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6

    • SHA512

      cbdcb5c3b31fdfa6d1add481d4e89e1fb1a81511048158c57dfc6bc9c646b67f971e202293071653f1deda21e721e5f764fdceab49e2da0a7d87dbb96d435f85

    • SSDEEP

      12288:a4GosyZUdGOV5Q0IHj5Mhh3Pr6XAAEjIBBTJIskD5LfWqnC1LEc6AZuA+Lk8YDi9:asu+3pO3peVfmuQtTxKFyqolZO7RP1E1

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (8626) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks