medusalocker | 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd

General

Target
9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip
Size 783KB
Sample261101-hm1xrsbf28
SHA256 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd
MD5 73f96814086ca7ef0198959ef7efecb5
SHA1 effac0ae143893755c2977fe68cd4e88b5a3c36e
SHA512 343066c0efaba102c8cbd60061754adceaeac1077b8139887ed51484c49c886de3e0a6e2bb853e842bd22b94cab21a5cc20f1e81f38b4a489e4ba423e93d6380
SSDEEP 24576:qZRgFNrIKEOyAjPIC55FM+svPoJU2rnrmBmC6YShizp:qZRgHIuySzPLryBmBep
TLSH
T10805337C90BBF7321C40CDAB4BE421AD931B3AD0AD422ADE5A1E354BC4BD379C4AD564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Recovery_Instructions.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">0929A87836D648B7FEFC239AEE0510B65B38391B726887D30813CEEC5C8447C0D8DD3F21E6A1C597785FF8F4290BBD7493358B6A760433534A819F15B06A8822<br>053B2A42A7FDA2743EC8C9FCE8013DDD0F56FE5442AF7CD280072D338A534E4EADF45B910FEB6DA404C81129F6A1BA6F63710C1CC863D68DF7501D2CF164<br>89EA16F9996677E54B69DE3547CE71BD9D1B49059F738C0D2D7693AF683E866F5C516F5E95DB83F17FAA8C75D56D2F06D0E8D1316B2BD1C3073EFDBBEBF5<br>D85C197A0685B0E4F00C5BBABFFDE4D65D0580B2B4BBAD0B4418EA165937958F6E9E291A4CF8D14CBB7D51B1428EECB9A3A88606B1DAF0F44A85BEC0C2EC<br>3B0D25DBC14890CA2982615CF97F65B9962F6E30E07C13B8224BB983DA238357C8B956A0CA5A1ABB738BF5CF575BAB5F3067ECEE7993310388BD0B81331D<br>83F16FEEA4157E04ACAE62C9809F1881AB515E770AC77D3C25FC0C9A3D33158A06C1673944F8FF28A2992458CB2594C22C5BB60ABC89848BBE4AECEF65B8<br>19F0E54AC54D16E32AC5B36EC2A7F449B3C5B925FAB23C72C0D9D1214895E63F07FC31FAC0FE4A78E17AD95542DA58DAAB3275B6B5DC4C197C8B26958C0A<br>B65F74B8940335082E2664B08594D431497C1854D75582077347285C1B042CD5264BDC509A9CF71EFE27520A3B3F634527F8C9A33658CD026DD4F1B52EC8<br>C65168D60F1CDBC77BAD9884DC1F</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-7gmHWAyvbpxQ49bIfiWluNbuLqdhtCWo</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected]</a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Extracted

Path

C:\Users\Admin\Downloads\Recovery_Instructions.html

medusalocker

Ransom Note

Your personal ID: 0929A87836D648B7FEFC239AEE0510B65B38391B726887D30813CEEC5C8447C0D8DD3F21E6A1C597785FF8F4290BBD7493358B6A760433534A819F15B06A8822 053B2A42A7FDA2743EC8C9FCE8013DDD0F56FE5442AF7CD280072D338A534E4EADF45B910FEB6DA404C81129F6A1BA6F63710C1CC863D68DF7501D2CF164 89EA16F9996677E54B69DE3547CE71BD9D1B49059F738C0D2D7693AF683E866F5C516F5E95DB83F17FAA8C75D56D2F06D0E8D1316B2BD1C3073EFDBBEBF5 D85C197A0685B0E4F00C5BBABFFDE4D65D0580B2B4BBAD0B4418EA165937958F6E9E291A4CF8D14CBB7D51B1428EECB9A3A88606B1DAF0F44A85BEC0C2EC 3B0D25DBC14890CA2982615CF97F65B9962F6E30E07C13B8224BB983DA238357C8B956A0CA5A1ABB738BF5CF575BAB5F3067ECEE7993310388BD0B81331D 83F16FEEA4157E04ACAE62C9809F1881AB515E770AC77D3C25FC0C9A3D33158A06C1673944F8FF28A2992458CB2594C22C5BB60ABC89848BBE4AECEF65B8 19F0E54AC54D16E32AC5B36EC2A7F449B3C5B925FAB23C72C0D9D1214895E63F07FC31FAC0FE4A78E17AD95542DA58DAAB3275B6B5DC4C197C8B26958C0A B65F74B8940335082E2664B08594D431497C1854D75582077347285C1B042CD5264BDC509A9CF71EFE27520A3B3F634527F8C9A33658CD026DD4F1B52EC8 C65168D60F1CDBC77BAD9884DC1F /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED! YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMENANTLY DESTROY YOUR FILE. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE SOLUTION TO YOUR PROBLEM. WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER. YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES BACK. Contact us for price and get decryption software. http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-7gmHWAyvbpxQ49bIfiWluNbuLqdhtCWo * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". 4. Start a chat and follow the further instructions. If you can't use the above link, use the email: [email protected] [email protected] MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

URLs

http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-7gmHWAyvbpxQ49bIfiWluNbuLqdhtCWo

Targets

- Target
  9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe
- Size 895KB
- SHA256 9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e
- MD5 4536297338323c00783fdceabf8d36bf
- SHA1 7ad1bf03b480ebd2b85b2bc5be4b9140b0ce6d4d
- SHA512 1d416a6057b6eb228a09b0865741e1a203c795a9e6da98c4a7318c38aa4c5de086619177434034e11996d5e4a3856e3b0d6cea33a888ef7d02d06474ed9d7582
- SSDEEP 24576:cpujQRfL2Zsfeik9HV+Ovkd4pBWLv01oqc1cTfOAf:cpbDYIk91/pIL0cYf
- TLSH
  T1F1151212B0C38477D2A12535063DB5708AB9FE300E39DB9B7BC8C26B5E1A5D1EB39706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan
- Family: MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  defense_evasion trojan
- Renames multiple (147) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1