General

  • Target

    16259167404.zip

  • Size

    321KB

  • Sample

    240328-nwry4sbf4z

  • MD5

    94e797f17313dc5d704d2d026a842e3d

  • SHA1

    9065e2ed6f99091c1ae62a298fe7aa11d85d9bce

  • SHA256

    2c7b5579d3764bfbaddd63412f6f053acbd9998fd78fcead83aaa3e685d64a34

  • SHA512

    bd887cf7c0fb44e4b5601d3c06208bbaa5e7a216046d3868a3aded4af894998a087973b289697d059c642af0cea7d2063057450cc8c3472d9707545a1606009f

  • SSDEEP

    6144:xzOgLEWrqFhj8mOHB70Zuj3An1WOMoEL05iKyWX22KpHF77i40AxgffkqyTnQeCR:lOgJmhjXOh/Qcoge2tHF7jxYs7TQRR

Malware Config

Extracted

Path

C:\$Recycle.Bin\!!!READ_ME_MEDUSA!!!.txt

Ransom Note
$$\ $$\ $$$$$$$$\ $$$$$$$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$\ $$$ |$$ _____|$$ __$$\ $$ | $$ |$$ __$$\ $$ __$$\ $$$$\ $$$$ |$$ | $$ | $$ |$$ | $$ |$$ / \__|$$ / $$ | $$\$$\$$ $$ |$$$$$\ $$ | $$ |$$ | $$ |\$$$$$$\ $$$$$$$$ | $$ \$$$ $$ |$$ __| $$ | $$ |$$ | $$ | \____$$\ $$ __$$ | $$ |\$ /$$ |$$ | $$ | $$ |$$ | $$ |$$\ $$ |$$ | $$ | $$ | \_/ $$ |$$$$$$$$\ $$$$$$$ |\$$$$$$ |\$$$$$$ |$$ | $$ | \__| \__|\________|\_______/ \______/ \______/ \__| \__| -----------------------------[ Hello, PetroChina !!! ]-------------------------- WHAT HAPPEND? ------------------------------------------------------------ 1. We have PENETRATE your network and COPIED data. * We have penetrated entire network including backup system and researched all about your data. * And we have extracted all of your important and valuable data and copied them to private cloud storage. 2. We have ENCRYPTED your files. While you are reading this message, it means all of your files and data has been ENCRYPTED by world's strongest ransomware. All files have encrypted with new military-grade encryption algorithm and you can not decrypt your files. But don't worry, we can decrypt your files. There is only one possible way to get back your computers and servers - CONTACT us via LIVE CHAT and pay for the special MEDUSA DECRYPTOR and DECRYPTION KEYs. This MEDUSA DECRYPTOR will restore your entire network, This will take less than 1 business day. WHAT GUARANTEES? --------------------------------------------------------------- We can post your data to the public and send emails to your customers. We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. https://breached.vc/Forum-Leaks https://www.nulled.to/#!Leaks https://t.me/+yXOcSjVjI9tjM2E0 After paying for the data breach and decryption, we guarantee that your data will never be leaked and this is also for our reputation. YOU should be AWARE! --------------------------------------------------------------- We will speak only with an authorized person. It can be the CEO, top management, etc. In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! If you do not contact us within 3 days, We will start publish your case to our official blog and everybody will start notice your incident! --------------------[ Official blog tor address ]-------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/ CONTACT US! ----------------------[ Your company live chat address ]--------------------------- Using TOR Browser(https://www.torproject.org/download/): http://medusacegu2ufmc3kx2kkqicrlcxdettsjcenhjena6uannk5f4ffuyd.onion/6FpWYNh2VT8tLYAkeQ0P Or Use Tox Chat Program(https://qtox.github.io/) Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F Our support email: ( medusa.serviceteam@protonmail.com ) Company identification hash: fb74336df24a22672b18f99406fde485af1aa79ad57fa3c92725bfc223f72538
Emails

medusa.serviceteam@protonmail.com

URLs

https://breached.vc/Forum-Leaks

https://www.nulled.to/#!Leaks

https://t.me/+yXOcSjVjI9tjM2E0

http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/

http://medusacegu2ufmc3kx2kkqicrlcxdettsjcenhjena6uannk5f4ffuyd.onion/6FpWYNh2VT8tLYAkeQ0P

Targets

    • Target

      736de79e0a2d08156bae608b2a3e63336829d59d38d61907642149a566ebd270

    • Size

      626KB

    • MD5

      47386ee20a6a94830ee4fa38b419a6f7

    • SHA1

      ee4575cf9818636781677d63236d3dc65652deab

    • SHA256

      736de79e0a2d08156bae608b2a3e63336829d59d38d61907642149a566ebd270

    • SHA512

      85b2d6e3b5faa4f3e41c1e8f3fbeab484c0e156b66d58307d6fcf84ebe1d5a277d7bbbe209f05ec4db0a179bf72a8a7ea567ae7576b0cc591477893749bd61d2

    • SSDEEP

      12288:fSNRvIULdPvv84Sex/nsroQ9QPooisHszx8a/ikU7fwgjMOJgf6aKX3RRGvRT735:QDvoxPN99AzRKSvXhQioLdGpjyzj+fNg

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (8477) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks