Overview

overview

10

Static

static

10

2026-01-05...ed.exe

windows10-2004-x64

10

2026-01-05...ed.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-01-05_d2739a449608861835b2e89f8401cf6b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_medusa-locker_medusalocker_njrat
  • Size 678KB
  • Sample260105-ex3bssam3x
  • SHA256 09dcbaee19a8302f4e9319a8ebc148d50b6ddf31d7e9b9c34850237b3afa682a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
medusalockerdefense_evasiondiscoveryransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • \Device\HarddiskVolume1\Recovery_Instructions.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">9C1C63B7F370254DF8A00946846A5954C1B69CEF818C55E9D4C36B99893753E67B417254D9E464054CFC6ED00A959351DC0FA69D98E0B5DECB531AFA7B72B6A3<br>E4212BFABDF77B8E42D1B064C4618DBD13AD5706958E29A0207E9200C1149F1552DE59F954FBF98351CB3E2812237ED7DA9AF023FFCA1FC74B23A5DC7AEA<br>68387786ACCEA7853B19B9759E292B5573BDB499CA755D83BAB0126C8D3A8A061F899463D09FF2112C9746B36D179125E69CE74C7B0289CDB0FC4C4420FC<br>60E8B331F1913E88B72ACB6EA1BEBAFA3281FF462838498EE91A1FE6C8B4836B71C2836E0B8622EE21FE4F24282F3709371786F9663ADE92CBC9F89F7474<br>E87D292F2ECD569A117AE103E1C076334B01255F8C84E5DB74C506AF60C56A701F763017F18C335B9ABB39DB6727CCF632B60D906E5F52D8BF16C6D2040D<br>A0BBFE8A959C28A4F6EA064EBF0211BB0BD4F16103213F477420994D1F18F2E96D26F787B96300813613E476653F2F1E2D6381C66B6372F8E336513F9BCD<br>36137C3B115E9C93EB7828B1E701C42E685554BCE662B50CC781AB8B346C078F5ABFA3697A28634D2E4949D91613CA4F4B48DF574D061B228C12CDBBA9B2<br>D34480F04C4677E2CC5DD5AF5A315F533E00D5957835B67C9BF5A94B9CFC62934ADFE66258A9B0E192C1C73EA393963B9C73B21626322F973E1F544BE7FD<br>6C4C52A19EFF1A899E7B6EE9C221</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/8-BEr5s2CLhrmCqH4xxg229SZxlkjCyDmc-agJMR3fEvBB8i2vl5fiwq8frkKddN0HW</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected] </a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

  • C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">70B7507C4EEEAEAF8EDF66BBC32EF7ED1FCC6655375582D06D0C63BD95F9192299FBA81B7D1EC369E0F0E3A5758B613E58D8087A890E0189FE5BC6775B414805<br>0CB0900E5907FEB16BE1E380B7FA78460DB3E25190B4BC38909C8C7E501D563B03C726A9F249EA50EAA35780D6C9729374F16374CA2A93F988B09CA055AD<br>82C5EB554602929EF89147495473E732B4DFD4AA290032B6FE152A9603944307DEA7A12B3FAA8ED14F34E6A196893FB574D95B0AFB5A4ADF585083B2A9A8<br>AE15F41F7B77F2AED6C33E091AB5E066F2A5859A934DD89CAC32E8C7EC25A05AABB000DCB0FD5748C774708BCD1BD616277AA1954EDF43CC38F32D53C2E0<br>947BFCF91F01F79EBCB8DFE0F1B3926E50FA7C6D35DB163E765C435438AAB803F43E336147D1F97A7C60D220CD5647C504F3190535492FDB3972BD283669<br>6E336E4F06458A0E60367A0750FD8633F51E0DBF021CF7672530BF40B1822851D7EC125153EFAAA3B1E306E8D26A06A9229EB64E49B34618961E48720F63<br>E79FDEFD44E1F76D2B99A0B02B5B26229A248C93BC7E9702FA8FB01E11784C9D938FE1E3B495E345BBCD47C7BBF5756809C522127B210445344EEF6A0A8B<br>824F4143AF03C9CAF161402CA8BC068733F5F706EEA6E337775B1F74386622FB9850F236F39894B54A7C5C17871F36E83E099AE17E63CEAF6FE8FB875C81<br>EE8C40BDA88C44CF6AE50E595761</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/8-BEr5s2CLhrmCqH4xxg229SZxlkjCyDmc-VFEM52hctVwOagS5Qljp83g20C6mOHQ7</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected] </a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target
      2026-01-05_d2739a449608861835b2e89f8401cf6b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_medusa-locker_medusalocker_njrat
    • Size 678KB
    • SHA256 09dcbaee19a8302f4e9319a8ebc148d50b6ddf31d7e9b9c34850237b3afa682a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverymedusalockerransomwarespywarestealertrojan

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

      ransomwaremedusalocker

    • MedusaLocker payload

    • Medusalocker family

      medusalocker

    • UAC bypass

      defense_evasiontrojan

    • Renames multiple (135) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks