Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
babylockerkz.exe.bin
-
Size
624KB
-
Sample
241113-pgf4qs1mdz
-
MD5
84b88ac81e4872ff3bf15c72f431d101
-
SHA1
0823d067541de16325e5454a91b57262365a0705
-
SHA256
4d4df87cf8d8551d836f67fbde4337863bac3ff6b5cb324675054ea023b12ab6
-
SHA512
185691b0103669c5aa25b22c36f29ddb66f074e0f2e3ae6a36ed8917c35f1fba71fba65c11c3211ce64f6c5919ac879ce0fdcc4dddae420cbecf40711dff1860
-
SSDEEP
12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
Static task
static1
Behavioral task
behavioral1
Sample
babylockerkz.exe
Resource
win11-20241007-en
Malware Config
Extracted
C:\$Recycle.Bin\!!!READ_ME_MEDUSA!!!.txt
http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion/
http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/227098164ef1fdb119ef537986bbdf24
Targets
-
-
Target
babylockerkz.exe.bin
-
Size
624KB
-
MD5
84b88ac81e4872ff3bf15c72f431d101
-
SHA1
0823d067541de16325e5454a91b57262365a0705
-
SHA256
4d4df87cf8d8551d836f67fbde4337863bac3ff6b5cb324675054ea023b12ab6
-
SHA512
185691b0103669c5aa25b22c36f29ddb66f074e0f2e3ae6a36ed8917c35f1fba71fba65c11c3211ce64f6c5919ac879ce0fdcc4dddae420cbecf40711dff1860
-
SSDEEP
12288:V4eCA30wfnlxvaUwZNf6qYID7ZJuIQOsknZh20QyCkje0ZM7qgbGKTO7muYpralU:3C8valgsDyfSBKXyMUkW2LILGBm3IzPB
Score10/10-
Medusa Ransomware
Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.
-
Medusaransomware family
-
Renames multiple (3237) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-