General
-
Target
16235419622.zip
-
Size
318KB
-
Sample
240328-nwqfaahc98
-
MD5
4d23b3ebdb4ae3a2fee0836781a3560c
-
SHA1
a883b69bf669ae47a0009eb262f2e72cb331cad6
-
SHA256
131e8818ae951f6ddb346c59f06ed0573b74861964e071bbfd370b876097f5db
-
SHA512
8841a19ee286e415e48a813517025e8c0a819c135c22f0f5824def66a1c3d57933ee8b114bf86067d09643e07a51fe52a5011420c051d158bd5dad23aca1eb4a
-
SSDEEP
6144:4Cmz+wP/tdi/+nV+eROxByVohpJqoiYuFZ93Y8vttQxPnVpWfEiYY:4Tyy/XnV+9xByVITqo+FZ97vttQx9pW3
Static task
static1
Behavioral task
behavioral1
Sample
3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
F:\!!!READ_ME_MEDUSA!!!.txt
https://www.the74million.org/article/from-campus-rape-cases-to-child-abuse-reports-worst-case-data-breach-rocks-mn-schools/
http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/
http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/291b071d62bd319d16df0b898c6cbf90
Targets
-
-
Target
3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6
-
Size
623KB
-
MD5
04581fa15276f0d55108ed58dceac710
-
SHA1
8b185c6b6f2cac6325f219612bddb7b0011caab4
-
SHA256
3581f1c9ee74f83d3d476aa5a947a040d9f2613a836232180c195f678b64dee6
-
SHA512
cbdcb5c3b31fdfa6d1add481d4e89e1fb1a81511048158c57dfc6bc9c646b67f971e202293071653f1deda21e721e5f764fdceab49e2da0a7d87dbb96d435f85
-
SSDEEP
12288:a4GosyZUdGOV5Q0IHj5Mhh3Pr6XAAEjIBBTJIskD5LfWqnC1LEc6AZuA+Lk8YDi9:asu+3pO3peVfmuQtTxKFyqolZO7RP1E1
Score10/10-
Renames multiple (8626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-