2026-10-25_9328f5cf136c0b7fc2b600d560f2c8e0_amadey_elex_medusalocker

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_9328f5cf136c0b7fc2b600d560f2c8e0_amadey_elex_medusalocker
Size 356KB
Sample261026-yfv1yags21
SHA256 a9250a2b92903d462b7ff8c57e5ed8a877fa1e45a88e6767053b7587df12dd67
MD5 9328f5cf136c0b7fc2b600d560f2c8e0
SHA1 29570f669f2b3cfb8c2ada45cfb251c22f4dcd5b
SHA512 7800319ecdf858e52046ec250fab3c7490161828d47e3aea71fcc16ff0b9f49d2ab6fb10c7b650f1dbc45eaa298638210d1d62d25f67f21ba5ec4dbe279c88b3
SSDEEP 6144:leJLCN6V9A+fDlYAokoPaK0lXi4tQOWuR4iXcKiCZgm0xB:let9A+fDiky0rjWuR4isC0z
TLSH
T18A748D223B8190B2D56242315FBCEB6B85BEB6500F3652D723C82E5CAEA05C35F35F56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-25_9328f5cf136c0b7fc2b600d560f2c8e0_amadey_elex_medusalocker

.exe 356KB

2026-10-25_9328f5cf136c0b7fc2b600d560f2c8e0_amadey_elex_medusalocker

IMPHASH 8151a48311c6a1156d63c9ea8ea48704
SHA256 a9250a2b92903d462b7ff8c57e5ed8a877fa1e45a88e6767053b7587df12dd67
MD5 9328f5cf136c0b7fc2b600d560f2c8e0
SHA1 29570f669f2b3cfb8c2ada45cfb251c22f4dcd5b
SHA512 7800319ecdf858e52046ec250fab3c7490161828d47e3aea71fcc16ff0b9f49d2ab6fb10c7b650f1dbc45eaa298638210d1d62d25f67f21ba5ec4dbe279c88b3
SSDEEP 6144:leJLCN6V9A+fDlYAokoPaK0lXi4tQOWuR4iXcKiCZgm0xB:let9A+fDiky0rjWuR4isC0z
TLSH
T18A748D223B8190B2D56242315FBCEB6B85BEB6500F3652D723C82E5CAEA05C35F35F56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

b6:df:1e:cf:63:65:0e:8d:83:3b:15:76:89:55:e6:5d:81:77:de:56:ba:3e:48:ce:9a:f6:d3:82:ad:df:05:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 5, 2024

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

b6:df:1e:cf:63:65:0e:8d:83:3b:15:76:89:55:e6:5d:81:77:de:56:ba:3e:48:ce:9a:f6:d3:82:ad:df:05:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG

Chains

Jul 27, 2022

CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG

Subject

CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG

Serial Number

ac:84:16:16:33:49:c1:c7:00:00:00:00:55:66:b7:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 10, 2020 - Feb 10, 2023

Subject

Serial Number

43:c1:0b:1c:00:00:00:00:51:d3:73:da

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 10, 2015 - Nov 10, 2030

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:10:bb:da:19:09:b3:f8:38:97:00:00:00:00:01:10

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 16, 2024 - May 14, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:0842-4BE6-C29A,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:da:8e:d5:c9:5a:00:d1:11:b1:00:01:00:00:01:da

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

111868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\J\PC\sources\Creative.Platform.Core\Release\Creative.UWPRPCService.pdb

kernel32

LoadLibraryW Sleep GetModuleFileNameW SubmitThreadpoolWork CreateThreadpoolWork LocalFree WaitForSingleObject SetEvent CreateEventW GetLastError ExpandEnvironmentStringsW ExpandEnvironmentStringsA UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes GetCurrentThread CreateTimerQueue LCMapStringW CompareStringW GetTickCount SwitchToThread DecodePointer GetModuleHandleExW QueueUserWorkItem TryEnterCriticalSection GetStringTypeW MultiByteToWideChar WideCharToMultiByte FormatMessageA LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError InterlockedFlushSList InterlockedPushEntrySList RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcAddress GetModuleHandleW InterlockedIncrement InterlockedDecrement CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx

advapi32

SetSecurityDescriptorDacl DeleteService QueryServiceStatus ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW EventWriteString SetServiceStatus EventUnregister EventRegister AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor StartServiceCtrlDispatcherW FreeSid RegisterServiceCtrlHandlerW

ole32

CoCreateGuid CoInitializeEx CoUninitialize PropVariantClear CLSIDFromString CoCreateInstance CoTaskMemFree

oleaut32

BSTR_UserSize BSTR_UserFree LPSAFEARRAY_UserMarshal BSTR_UserMarshal BSTR_UserUnmarshal LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserSize

api-ms-win-crt-math-l1-1-0

__setusermatherr _CIsqrt _CIexp frexp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn terminate exit abort _errno _controlfp_s _register_thread_local_exe_atexit_callback _c_exit __p___wargv _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type __p___argc _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-stdio-l1-1-0

fclose _wfopen_s fopen_s fread fputc __p__commode __stdio_common_vsprintf_s _get_stream_buffer_pointers ungetc setvbuf fwrite __stdio_common_vfwprintf __stdio_common_vfprintf_s _fseeki64 fsetpos __stdio_common_vfprintf __stdio_common_vswprintf _set_fmode __acrt_iob_func fgetpos fgetc fgetwc fputwc ungetwc fflush

api-ms-win-crt-locale-l1-1-0

localeconv ___mb_cur_max_func _configthreadlocale ___lc_codepage_func __pctype_func ___lc_collate_cp_func _lock_locales ___lc_locale_name_func _unlock_locales setlocale

api-ms-win-crt-string-l1-1-0

islower _wcsdup wcsncmp strcpy_s __strncnt _wcsicmp strcspn wcscpy_s isupper wcsnlen

rpcrt4

RpcServerUseProtseqEpW NdrServerCall2 NdrClientCall2 RpcServerRegisterIf3 RpcBindingVectorFree RpcEpUnregister RpcServerUnregisterIf RpcServerListen RpcEpRegisterW RpcServerInqBindings

propsys

InitPropVariantFromCLSID

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ws2_32

send inet_ntop recv WSAGetLastError freeaddrinfo closesocket connect WSAStartup gethostname socket getaddrinfo WSACleanup

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_9328f5cf136c0b7fc2b600d560f2c8e0_amadey_elex_medusalocker

kernel32

advapi32

ole32

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

rpcrt4

propsys

api-ms-win-security-base-l1-2-2

ws2_32

api-ms-win-crt-filesystem-l1-1-0

generic