medusalocker | 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd

General

Target
9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip
Size 783KB
Sample261101-hpcb7ahs5w
SHA256 78687d0c848d1f936fba1604b08f0b82171ed4876c703a36a03ae25798f9adfd
MD5 73f96814086ca7ef0198959ef7efecb5
SHA1 effac0ae143893755c2977fe68cd4e88b5a3c36e
SHA512 343066c0efaba102c8cbd60061754adceaeac1077b8139887ed51484c49c886de3e0a6e2bb853e842bd22b94cab21a5cc20f1e81f38b4a489e4ba423e93d6380
SSDEEP 24576:qZRgFNrIKEOyAjPIC55FM+svPoJU2rnrmBmC6YShizp:qZRgHIuySzPLryBmBep
TLSH
T10805337C90BBF7321C40CDAB4BE421AD931B3AD0AD422ADE5A1E354BC4BD379C4AD564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Recovery_Instructions.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">3EB992B1DF84A4AA907A1CF35AAFFFA90E67730D960CFA4D341F2705362B016DEB329C999237BE3C7258C0E9942D5A2C14B27ABFC30F7C82CFA806373721C541<br>F7682F04E101B069883E1889531EEE7E0376CD39DAFED11E690103FCA45F83BFAD9B660C204DC0AA88D4CE0C3071B4EDD45F9A6ECC76E378FD3F68A64B56<br>B50E3CE7D4D4A715D7D68B6EE82D95E425756B506F1061881BC40B7F8211DE9A18CD90054294A7E4833FEFD4E7EC674A696A26D8F60FF57BE4408067F24C<br>CE8EEA8AB071397D79A925933209780C53E4F86E7A085585426ED20E1AA74809A08E493EBF9DC2D67A5A9387DBAFCC84EAC22734FEBFF43335460946EE4B<br>B3D125998EAE08064C8129B080AB84F12F92204F50F0CED5207F5CD46999E1AF5302EFAD71F5E7985959E770087561E359D7AB6B18DEC4F36394935724FF<br>B3CE9BF8AC3960565A8EE76D4585806034585DC1F26BD45E53F5DB17B124F73CA5B634C349FAB391310C5AA06ED862CC329072E85311BEDB6F8DFD83AA8F<br>7BECB2A4BA27EAF7CE9A21F14636053BB2FB34133AC42AE55038FF6B5BB8FE2B4E89B4866D0D13EC7478F39F1279232B04B84B5D27AF4A99FC6B64195307<br>03B6AF7C92DB919887FAB200992B31D405E3321EF8A37E71A1A4DDF6B5576400812DF2182C49EDF179450FD81CF3C185B148D39903BAE94FA9759A477A12<br>42273BEC4BB6962F21BD94E67A06</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-OQkbNw3i4LCcHrcia2giPWvmnDL7tXoU</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected]</a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Extracted

Path

C:\Users\Admin\Downloads\Recovery_Instructions.html

medusalocker

Ransom Note

Your personal ID: 3EB992B1DF84A4AA907A1CF35AAFFFA90E67730D960CFA4D341F2705362B016DEB329C999237BE3C7258C0E9942D5A2C14B27ABFC30F7C82CFA806373721C541 F7682F04E101B069883E1889531EEE7E0376CD39DAFED11E690103FCA45F83BFAD9B660C204DC0AA88D4CE0C3071B4EDD45F9A6ECC76E378FD3F68A64B56 B50E3CE7D4D4A715D7D68B6EE82D95E425756B506F1061881BC40B7F8211DE9A18CD90054294A7E4833FEFD4E7EC674A696A26D8F60FF57BE4408067F24C CE8EEA8AB071397D79A925933209780C53E4F86E7A085585426ED20E1AA74809A08E493EBF9DC2D67A5A9387DBAFCC84EAC22734FEBFF43335460946EE4B B3D125998EAE08064C8129B080AB84F12F92204F50F0CED5207F5CD46999E1AF5302EFAD71F5E7985959E770087561E359D7AB6B18DEC4F36394935724FF B3CE9BF8AC3960565A8EE76D4585806034585DC1F26BD45E53F5DB17B124F73CA5B634C349FAB391310C5AA06ED862CC329072E85311BEDB6F8DFD83AA8F 7BECB2A4BA27EAF7CE9A21F14636053BB2FB34133AC42AE55038FF6B5BB8FE2B4E89B4866D0D13EC7478F39F1279232B04B84B5D27AF4A99FC6B64195307 03B6AF7C92DB919887FAB200992B31D405E3321EF8A37E71A1A4DDF6B5576400812DF2182C49EDF179450FD81CF3C185B148D39903BAE94FA9759A477A12 42273BEC4BB6962F21BD94E67A06 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED! YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMENANTLY DESTROY YOUR FILE. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE SOLUTION TO YOUR PROBLEM. WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER. YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES BACK. Contact us for price and get decryption software. http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-OQkbNw3i4LCcHrcia2giPWvmnDL7tXoU * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". 4. Start a chat and follow the further instructions. If you can't use the above link, use the email: [email protected] [email protected] MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

URLs

http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-OQkbNw3i4LCcHrcia2giPWvmnDL7tXoU

Targets

- Target
  9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe
- Size 895KB
- SHA256 9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e
- MD5 4536297338323c00783fdceabf8d36bf
- SHA1 7ad1bf03b480ebd2b85b2bc5be4b9140b0ce6d4d
- SHA512 1d416a6057b6eb228a09b0865741e1a203c795a9e6da98c4a7318c38aa4c5de086619177434034e11996d5e4a3856e3b0d6cea33a888ef7d02d06474ed9d7582
- SSDEEP 24576:cpujQRfL2Zsfeik9HV+Ovkd4pBWLv01oqc1cTfOAf:cpbDYIk91/pIL0cYf
- TLSH
  T1F1151212B0C38477D2A12535063DB5708AB9FE300E39DB9B7BC8C26B5E1A5D1EB39706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan
- Family: MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  defense_evasion trojan
- Renames multiple (155) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1