Extracted

• • Target
    2026-07-04_6c55cfe8ebbddab5f5cec728878da0a2_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat
  • Size 689KB
  • SHA256 ddad3e3ccd5209b52da8b2cba191d0b150fcf9d7e8c52ff3710342aef364c831
  • MD5 6c55cfe8ebbddab5f5cec728878da0a2
  • SHA1 0d1d9d3ba290a2cfe6ca82f7010efa7c3e506b53
  • SHA512 d7949533beadaace3f0df32cd2f605870e1f4247cc1f2ad4a6076f6d9c89c513321df75340602f2ca1f30b3fbd536693a0e78cfb0fca17d7ff986a6605e31364
  • SSDEEP 12288:2AkaGQbDzAaAHZsznxmFoKXjHjq0eO7xWmgTWJJCy50+z63LcTpQ2vkV+3a3Jl93:2AvrggdqUjeLFsmXWfhANTSw0u6POokw
  • TLSH
    T164E48E267442C076D5720231495CABA6637FFC314B734BEB67C05A6E5E742E06F32A3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoverymedusaransomwarepersistenceransomwarespywarestealer

  • Family: Medusa Ransomware

    Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.

    ransomwaremedusaransomware

  • Renames multiple (10270) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2