medusalocker | 417a5b53e3615d371bce0f5270911486d81b9784403c61b1343b0540ed97ddb4

General

Target

2025-01-09_278a2191a39df795ad5e9c5ae93c6c41_cobalt-strike_medusalocker
Size

1.3MB
Sample

250109-mr4xfaxnev
MD5

278a2191a39df795ad5e9c5ae93c6c41
SHA1

1f01d489c57eb590f7d0900d601898685d904666
SHA256

417a5b53e3615d371bce0f5270911486d81b9784403c61b1343b0540ed97ddb4
SHA512

f2f4f6f2d41f071ea64bd9d01032791132e852c31f0fcf7be840f88ccc68dc08e9785909c911f03b25e53eb32cfc3a001a5a7aa89b8ed69cc8e11b4275d31d3d
SSDEEP

12288:QmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXl:HHRFfauvpPXnMKqJtfiOHmUd8QTH1

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note

From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 =20 =20 All your valiable data has been encrypted! =20 =20 =20 Hello! Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely. =20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information. =20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone. =20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit. Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us. =20 =20 If you want to resolve this situation, please write to ALL of these 2 email addresses: =20 [email protected] [email protected] In subject line please write your ID: 15519844421465902702 =20 =20 =20 Important! =20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered. =20 * Our message may be recognized as spam, so be sure to check the spam folder. =20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service. =20 Important =20 * Please don't waste the time, it will result only additinal damage to your company! =20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified. =20 =20 =20 </BODY> =20 </HTML>

Emails

[email protected] [email protected] In

URLs

http-equiv=3D"X

Extracted

Path

\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.mht

Ransom Note

From: =?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?= Subject: Date: San, 00 Jan 2000 00:00:00 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft MimeOLE =EF=BB=BF<!DOCTYPE HTML> <!DOCTYPE html PUBLIC "" "">=20 <HTML lang=3D"ru">=20 <HEAD>=20 <META = content=3D"IE = 3D11.0000" http-equiv=3D"X - UA - Compatible">=20 <META charset=3D"utf-8">=20 <TITLE>!!!HOW_TO_DECRYPT!!!</TITLE>=20 <LINK href=3D"style.css" rel=3D"stylesheet">=20 <META name=3D"GENERATOR" content=3D"MSHTML 11.00.10570.1001">=20 </HEAD>=20 <BODY>=20 =20 =20 All your valiable data has been encrypted! =20 =20 =20 Hello! Sorry, but we have inform you that your order has been blocked due to the issue of securities. Make sure your data is not blocked.=20 All your valuable files were encrypted with strong encryption algorithms AES-256 + RSA-2048 + CHACHA and renamed. You can read about these algorithms in Google.=20 Your unique encryption key is stored securely on our server and your data can be decrypted quickly and securely. =20 We can prove that we can decrypt all of your data. Please just send us 3 small encrypted files which are randomly stored on your server.=20 We will decrypt these files and send them to you as a proof. Please note that files for free test decryption should not contain valuable information. =20 As you know information is the most valuable resource in the world. That's why all of your confidential data was uploaded to our servers.=20 If you need proof, just write us and we will show you that we have your files. If you will not start a dialogue with us in 72 hours=20 we will be forced to publish your files in the Darknet. Your customers and partners will be informed about the data leak by email or phone. =20 This way, your reputation will be ruined. If you will not react, we will be forced to sell the most important information such as databases=20 to interested parties to generate some profit. Please understand that we are just doing our job. We don't want to harm your company.=20 Think of this incident as an opportunity to improve your security. We are opened for dialogue and ready to help you. We are professionals,=20 please don't try to fool us. =20 =20 If you want to resolve this situation, please write to ALL of these 2 email addresses: =20 [email protected] [email protected] In subject line please write your ID: 6558281558436675638 =20 =20 =20 Important! =20 * We asking to send your message to ALL of our 2 email adresses because for various reasons, your email may not be delivered. =20 * Our message may be recognized as spam, so be sure to check the spam folder. =20 * If we do not respond to you within 24 hours, write to us from another email address. Use Gmail, Yahoo, Hotmail, or any other well-known email service. =20 Important =20 * Please don't waste the time, it will result only additinal damage to your company! =20 * Please do not try to decrypt the files yourself. We will not be able to help you if files will be modified. =20 =20 =20 </BODY> =20 </HTML>

Emails

[email protected] [email protected] In

URLs

http-equiv=3D"X

Targets

- Target
  
  2025-01-09_278a2191a39df795ad5e9c5ae93c6c41_cobalt-strike_medusalocker
- Size
  
  1.3MB
- MD5
  
  278a2191a39df795ad5e9c5ae93c6c41
- SHA1
  
  1f01d489c57eb590f7d0900d601898685d904666
- SHA256
  
  417a5b53e3615d371bce0f5270911486d81b9784403c61b1343b0540ed97ddb4
- SHA512
  
  f2f4f6f2d41f071ea64bd9d01032791132e852c31f0fcf7be840f88ccc68dc08e9785909c911f03b25e53eb32cfc3a001a5a7aa89b8ed69cc8e11b4275d31d3d
- SSDEEP
  
  12288:QmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXl:HHRFfauvpPXnMKqJtfiOHmUd8QTH1
Score

10^/10

credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (882) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2