medusalocker

General

Target

26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0.exe
Size

669KB
Sample

240507-jm21haac68
MD5

646698572afbbf24f50ec5681feb2db7
SHA1

70530bc23bad38e6aee66cbb2c2f58a96a18fb79
SHA256

26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
SHA512

89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a
SSDEEP

12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe

Score

10^/10

Malware Config

Extracted

Path

\Device\HarddiskVolume1\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">CAB6FE85CB3FA3C3565E4F9D5B3FDB349916C77A497539A06F18282F8F5CDA972B907BE59AC2291717E2D6EAA41C5EC5D654270E04E112687515988BAFB4965F<br>1EDCF87B6E83CD8F56906F5C68F43CD947128E630F239A0E172F9B5E294CA045A99A2A814D7A13CB9A30C7DF45FAC106679FD223D42480B1E0C09C8184B2<br>960A9110F7D9E062BEADC290B4BA460F3CD4E65B8F71E505EFBE854A48997B859154EDB0BB38EC93223256B2314C4BF2AB5F4CB3003F85F19C46399EF09A<br>6672F3A474807BBFE6B3CD9BCB681833121A68176A9A06743B376B207F54182C0DE024E2B8637860AFC2F768A419A796B85E04DA92E8345EE199FCDBA1B6<br>57970C5392649F7D135456D184053B110C834E1206649A1B7273D8E8AC3E809784B9BF440FA4AB421A62B933326D8D40CDD125FB70E0FBC801CED967C741<br>54D5E1115C0385E9ACA70C870A225C0C66E737BBC864E9DC93C49745F041B44E67179C4D479B217D7031D6C133736289570A2699DE92B735ACB8B883C3DB<br>3D2312B6A5A43EF7C9C9013F0635A0ECA14EB236FDFACA715201CF6B6FD301E783AB00A798FE0AAC05969A0FC0492CDC65F8E58625FFEF1A5A21F6694D91<br>303D1FE3BDD3E287A7B7181A3DCE7FE0B5362CC6093816061C40798A90FFF1C230576255DAF37B12F5953005ACE1850929897B164F3B790658C35A2288A3<br>17AD8D021B5B813F178D5D3DFD3B</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion<br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

href="[email protected]

">[email protected]

href="[email protected]

">[email protected]

Targets

- Target
  
  26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0.exe
- Size
  
  669KB
- MD5
  
  646698572afbbf24f50ec5681feb2db7
- SHA1
  
  70530bc23bad38e6aee66cbb2c2f58a96a18fb79
- SHA256
  
  26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0
- SHA512
  
  89bad552a3c0d8b28550957872561d03bf239d2708d616f21cbf22e58ae749542b07eee00fedac6fdb83c5969f50ea0f56fc103264a164671a94e156f73f160a
- SSDEEP
  
  12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8D4KD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWdKrKe
Score

10^/10

medusalocker evasion ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  evasion trojan
- Renames multiple (195) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1