medusalocker | 96dce9c6bbd0e2f156408e1e1adb7223d8748825fae80b966e80a2b34027aad1

General

Target
96dce9c6bbd0e2f156408e1e1adb7223d8748825fae80b966e80a2b34027aad1
Size 2.3MB
Sample260812-rqqewaygmc
SHA256 96dce9c6bbd0e2f156408e1e1adb7223d8748825fae80b966e80a2b34027aad1
MD5 3b5dbf89e3609e0cc34d201dc0ebc0f3
SHA1 ace1d889a3cfcb880191abadb771a15833af08fb
SHA512 47a5c8af74b5d057f5077ba299746b1d46722c7441a87c5fbc482bd8756221f1e8f95fa74a36de30349708770ebdb8ec4fda9071cb053182bd72c25df10f0cc5
SSDEEP 49152:65TJfEYfEdY28G1jv8CcFeV2qFmat9vdenEunq6o4K7eBm0gtfBGCb8n:6VffE+tqoCcFsLdt9vde+4K7EmHfwCbM
TLSH
T140B5338D8796DDDDE6C49270313738500F0603F38DCA696454AF0B4F59E8BAC96AEBE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da.exe
- Size 2.5MB
- SHA256 0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da
- MD5 e63e41e15e86489a98dbeb2e6cb44e8a
- SHA1 5815d349a375f5cdf090ababcff86b3946ed6c07
- SHA512 749d9580ac631916fbc1db207f0f48ed2ff9979f0cd8e352633cd86edfe7bd5bbb6da90b014e0b8ad639f8b9e567498f07353ef907ce2bd6dfa5536d3079991e
- SSDEEP 49152:p+9pcEvA81ugLUKnGkFfHTvdlhylPdVkdL6rMD0uVVePR2EW:ktLUm3FfzvojKdLCAoPR2V
- TLSH
  T135C5230A6DED4AF5EB69D770DAB200932A21FC10DA3585C13DDB909FC4436389B68F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution medusalocker impact persistence ransomware spyware stealer themida trojan
- Family: MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (1175) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops file in Drivers directory
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2