medusalocker

General

Target
http://google.com
Sample251002-qbzvbscq31

Score

10^/10

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">8F24D08508B37C9F215BF2DDE2AB5735729FC07578889409C51293004F484197B82CD2195D96C3277E8CA6F8621E52E35E28FA12A6162F139E2C32C28B76CBB5<br>6EA32532A39ACBAD07AE9327609E89A36661DFB1BBC8E6D590C7BD3A11E5B87CF66D7F39F7DFFC7CA3C7726D3954E6D4AEDD3E866508F70BE76E15E280CC<br>76558ACD41D1D857E7C3D6096AE0EBEB9D7D39934820975FC7E1DFD32481375823272DD9296837F9F513DBC7522D7F3642276648738F093D8AB98F0A91AA<br>978C4BC1C50A3EF05157D556EFE95CD3FF350F411639737A004A41EC7116401A84EBC7296E548B6A1EBC92C2086F726B34DA1F041775692A255C91A1BB89<br>17E15E3B5282A90232ED4F22A50B0C78770A6E6B7CDD4D041CA67E590719F506091EBC7B12D6D379EA203019D50D3C36186904C612DC22897C8959ECC2A4<br>81C919B35877BE55528698460D9272E44CA70872CD7B93D91ACCCBA6136A9BA5744EDAC6D09C8DF15992330A19A81C86025F042D5DFB94059DEE88727E8E<br>D8A80EC8BA0FD4D24F06E149F6C87326BB0F73639366218EC1BD513A876519CBE00890AFE10362307DDFB3C4195FA5DE502D505477CFD89A8D9294827053<br>925B9990FD51C3D38AE8EB52AF98F3DC4A737140C3B7E429D785FCE3A462D19B09CCA30E21AD253B072E9A13B7380CB6BA896E81C3AC18E8501CC6A4A307<br>E402AD966EEBB0704D2EE4478413</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Targets

- Target
  http://google.com
Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan
- MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- Medusalocker family
  medusalocker
- UAC bypass
  defense_evasion trojan
- Renames multiple (218) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral1