medusalocker | 2024-06-24_91f04a8a9bd3b68f6b62479eb915af6f_cobalt-strike_medusa-locker

General

Target

2024-06-24_91f04a8a9bd3b68f6b62479eb915af6f_cobalt-strike_medusa-locker
Size

678KB
MD5

91f04a8a9bd3b68f6b62479eb915af6f
SHA1

fb11c2e6eaedf94675b9a606cff07314a6ba2141
SHA256

6612271bac6fcdda5e7081ce6777018fad4bb0f32354cb281387a11c851bcc08
SHA512

7bc3787dcb03149bed5902f3682cfc6afc8eaceaa7c4a9ed4a4ada4b5480bea5f46147732e389fcb3565eaae239f71f3673991fa48ef50cca8ad446e045d7dfb
SSDEEP

12288:+PJ4UhTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJ4ugP:feTYVQ2qZ7aSgLwuVfstRJ4v

Score

10^/10

medusalocker

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects command variations typically used by ransomware 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

MedusaLocker payload 1 IoCs

Processes:

resource yara_rule

sample family_medusalocker
Medusalocker family
medusalocker

resource	yara_rule
sample	family_medusalocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-06-24_91f04a8a9bd3b68f6b62479eb915af6f_cobalt-strike_medusa-locker