Overview

overview

10

Static

static

10

Videos/64/64.exe

windows7-x64

1

Videos/64/64.exe

windows10-2004-x64

8

Videos/64/86.exe

windows7-x64

3

Videos/64/86.exe

windows10-2004-x64

6

Videos/64/...E.html

windows7-x64

3

Videos/64/...E.html

windows10-2004-x64

8

Videos/64/dump.bat

windows7-x64

9

Videos/64/dump.bat

windows10-2004-x64

9

Videos/64/mimidrv.sys

windows7-x64

10

Videos/64/mimidrv.sys

windows10-2004-x64

10

Videos/64/...tz.dll

windows7-x64

1

Videos/64/...tz.dll

windows10-2004-x64

6

Videos/64/mimilib.dll

windows7-x64

1

Videos/64/mimilib.dll

windows10-2004-x64

8

Videos/64/...ol.dll

windows7-x64

1

Videos/64/...ol.dll

windows10-2004-x64

8

Videos/Adv...69.exe

windows7-x64

4

Videos/Adv...69.exe

windows10-2004-x64

6

Videos/Cap...E.html

windows7-x64

3

Videos/Cap...E.html

windows10-2004-x64

8

Videos/PsExec.exe

windows7-x64

3

Videos/PsExec.exe

windows10-2004-x64

8

Videos/PsExec64.exe

windows7-x64

1

Videos/PsExec64.exe

windows10-2004-x64

8

Videos/READ_NOTE.html

windows7-x64

3

Videos/READ_NOTE.html

windows10-2004-x64

8

Videos/crypt154.exe

windows7-x64

10

Videos/crypt154.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample.zip

  • Size

    21.2MB

  • MD5

    dd2ae63fda290349d4872d076c3999fa

  • SHA1

    d071bf47cb2eb4a8ade4c356c2da448fb5bf2ff8

  • SHA256

    b6ae167bc7a98a16120698f2f11452449118662dd3f1cc88e6ef7286465b45ca

  • SHA512

    7b01261129b1944d90ac79be21f104095c408995cf80b190287d37805d198ff8729db8011c73b0a4387614f68d4872ab5715f170b5a06ccd73603419674056e3

  • SSDEEP

    393216:6MUztzHK7whMRoPVnksbllihtvB4Jdgho+TtdGSa0n+jfnYAdylxQ0C1/Okd+:6Mm9K7waRckqlIhtv+JKhaG+jTdEe1v+

Score
10/10
ransomwaremimikatzmedusalocker

Malware Config

Extracted

Family

medusalocker

Ransom Note
Your personal ID: 2YfZTHQAYUl7kqDJYxaXaCaffwquavSjUP24kjLnTnrpeJuLdxD4T6h4Q9iZj+8XvI1Yjjz+/Wif2pnjz8LXyL3ZICXdy1EJbcn12KlzsLeLtxzOrVUtywGvseN6Td/GxgeXoJUdhB3ZPKuyIgUlPzrHX29VvwBr61OfVZq2IMv+aqhx55n1UQLyzQ2tg9eXSYytu8l+k7k6O5lm8xkSqCUGdhwVrh81v3w1oHQ9A0ajsdq1lAkTLaBXh8HzU6GFK3G05cflF2tlsb0movkB412dw0ZznhfcBNHSlF2NAQuRPa4Ga+XYkaYfzIKm3zyxFX724KkmjPsSyma+L9WWGw==� /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. * Tor-chat to always be in touch: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Signatures

  • Medusalocker family
    medusalocker
  • Mimikatz family
    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • sample.zip
    .zip
  • Videos/64/64.exe
    .exe windows:6 windows x64 arch:x64

    23e9f1e1d6aeb789637571e507824244


    Headers

    Imports

    Sections

  • Videos/64/86.exe
    .exe windows:5 windows x86 arch:x86

    ca37f3f3e8c3bc5843cfddf0de356d3a


    Code Sign

    Headers

    Imports

    Sections

  • Videos/64/READ_NOTE.html
    .html
  • Videos/64/dump.bat
  • Videos/64/dump.zip
    .zip
  • Videos/64/mimidrv.sys
    .sys windows:6 windows x64 arch:x64

    a63c276e82b09fa57509d7958aa9d208


    Code Sign

    Headers

    Imports

    Sections

  • Videos/64/mimikatz.dll
    .dll windows:5 windows x64 arch:x64

    5f7014bbc9816fb4fe5b6ea815ee88d8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Videos/64/mimilib.dll
    .dll windows:5 windows x64 arch:x64

    eaa79f1d9e8a00542b09cb462d0658ef


    Headers

    Imports

    Exports

    Sections

  • Videos/64/mimispool.dll
    .dll windows:5 windows x64 arch:x64

    c38ebbf4627ca2303746c77210e5a12e


    Headers

    Imports

    Exports

    Sections

  • Videos/Advanced_Port_Scanner_2.5.3869.exe
    .exe windows:5 windows x86 arch:x86

    48aa5c8931746a9655524f67b25a47ef


    Code Sign

    Headers

    Imports

    Sections

  • Videos/Captures/READ_NOTE.html
    .html
  • Videos/Captures/desktop.ini
  • Videos/PsExec.exe
    .exe windows:5 windows x86 arch:x86

    c1e59519b5e5d84af07afa6f5a8625f1


    Code Sign

    Headers

    Imports

    Sections

  • Videos/PsExec64.exe
    .exe windows:5 windows x64 arch:x64

    159d56d406180a332fbc99290f30700e


    Code Sign

    Headers

    Imports

    Sections

  • Videos/READ_NOTE.html
    .html
  • Videos/crypt154.exe
    .exe windows:6 windows x64 arch:x64

    ae5c56576b41c76e45888c3b9fb91934


    Headers

    Imports

    Sections

  • Videos/desktop.ini
  • Videos/output.bmp