medusalocker

General

Target

0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da.exe
Size

2.5MB
Sample

240507-hbsf9agb25
MD5

e63e41e15e86489a98dbeb2e6cb44e8a
SHA1

5815d349a375f5cdf090ababcff86b3946ed6c07
SHA256

0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da
SHA512

749d9580ac631916fbc1db207f0f48ed2ff9979f0cd8e352633cd86edfe7bd5bbb6da90b014e0b8ad639f8b9e567498f07353ef907ce2bd6dfa5536d3079991e
SSDEEP

49152:p+9pcEvA81ugLUKnGkFfHTvdlhylPdVkdL6rMD0uVVePR2EW:ktLUm3FfzvojKdLCAoPR2V

Score

10^/10

Malware Config

Targets

- Target
  
  0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da.exe
- Size
  
  2.5MB
- MD5
  
  e63e41e15e86489a98dbeb2e6cb44e8a
- SHA1
  
  5815d349a375f5cdf090ababcff86b3946ed6c07
- SHA256
  
  0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da
- SHA512
  
  749d9580ac631916fbc1db207f0f48ed2ff9979f0cd8e352633cd86edfe7bd5bbb6da90b014e0b8ad639f8b9e567498f07353ef907ce2bd6dfa5536d3079991e
- SSDEEP
  
  49152:p+9pcEvA81ugLUKnGkFfHTvdlhylPdVkdL6rMD0uVVePR2EW:ktLUm3FfzvojKdLCAoPR2V
Score

10^/10

medusalocker defense_evasion evasion execution impact persistence ransomware spyware stealer themida trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (618) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2