medusalocker | f060bc4b9959c37f3d967ae68a921b43eab26907153e22ea322a05c423bc1314

General

Target
9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.zip
Size 783KB
Sample261105-sgfdzsdt6m
SHA256 f060bc4b9959c37f3d967ae68a921b43eab26907153e22ea322a05c423bc1314
MD5 1f71596550025173cab5386c64410f99
SHA1 a022fd0bc25e0e8d661e5e9ba156918eed63c8c2
SHA512 f37442fc52e469c96274b26a27eecd1899360298cb87e6115c610fde2794fdcea4eeab8b490d23979539c4eac4a7190ee1eed74a1d3471791db86c1ca50c80f7
SSDEEP 12288:0sn7rG3L5qcbR2/dYVFKXod/0fV/tliDHIO7rbHq7tUx5TCBoiuUdknuy6E6XxJW:RHG3tqct9EoTI6rzqkdciuy6pGJrD
TLSH
T1B8053308BF57D23D828D6839558437035E99A98F6A219A0B7BFE424C363F05CD6BF25C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">CBCC0DF7BEB2F9D69F76FF29B78E9B5016F7E02CFBFC522E60E013F8B2D3A0752D8D85CE8361CA9942EA4AF986FB6C9B5583FD801804D77F252985D483DF1211<br>71142DBA781A9D15F6AA63CDEB8C22D3060F414156639E02B7D5AC503DC614F8BF2816D89C890DF8D51723D60355D9D20CF3CD14C7572B3098008038507C<br>EAD6A4EEF6E8BC55CEA25B00DB6A55F4E45AE7C3AF3900A71C9177BBC377C26A38C6CEB23D1D1E26C9C93C08B91CE972D3C118F22C3579CB3226808A1FB6<br>B47547862655BCBC3184296DC4EEFB8212B623F2EA7C03CC65D62564D0E66D48B36F27F0413BC8B026E8AC03EB9F5F9EC1901BD038FBEDCB75C123B51B56<br>48935460178F0A5C694CE874E3C874D17839012808C135349F769FA1A32B1FD2BF0919851C306317267E6C2B371D23AF295C687898AE59CE50D915D99DC4<br>5FD3F5C6D2CEBB50585EEC669721B7D5A0CC7DAE949B2FE1C09AAA74DBA58E36BA6EE17CF2E97FB0F9270975412F0497BE6703ABE22D6AE3F22746EB8234<br>A6EA58BE63FFBD21BD69C19F7F87DA312A122C7FC9B0B2FE2A44AF7A4109A270451BBA7C9E1F67C78C320A223AC27D034E5889B3EAB859E0F349FFE44C17<br>A20736008B1BD07D1B6FC1F694943EC835B71101C2970B7A4544A901D93DEDDBFAC7A53D2C656E2706246350896603FC04D062101C2CCF70D2FADA41309C<br>50C6A97C1039A9C7B199F48B0101</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-n5bVa3TID45ZZJYxFsl56gjHgRHJugtQ</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected]</a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Extracted

Path

C:\Users\Admin\Downloads\Recovery_Instructions.html

medusalocker

Ransom Note

Your personal ID: CBCC0DF7BEB2F9D69F76FF29B78E9B5016F7E02CFBFC522E60E013F8B2D3A0752D8D85CE8361CA9942EA4AF986FB6C9B5583FD801804D77F252985D483DF1211 71142DBA781A9D15F6AA63CDEB8C22D3060F414156639E02B7D5AC503DC614F8BF2816D89C890DF8D51723D60355D9D20CF3CD14C7572B3098008038507C EAD6A4EEF6E8BC55CEA25B00DB6A55F4E45AE7C3AF3900A71C9177BBC377C26A38C6CEB23D1D1E26C9C93C08B91CE972D3C118F22C3579CB3226808A1FB6 B47547862655BCBC3184296DC4EEFB8212B623F2EA7C03CC65D62564D0E66D48B36F27F0413BC8B026E8AC03EB9F5F9EC1901BD038FBEDCB75C123B51B56 48935460178F0A5C694CE874E3C874D17839012808C135349F769FA1A32B1FD2BF0919851C306317267E6C2B371D23AF295C687898AE59CE50D915D99DC4 5FD3F5C6D2CEBB50585EEC669721B7D5A0CC7DAE949B2FE1C09AAA74DBA58E36BA6EE17CF2E97FB0F9270975412F0497BE6703ABE22D6AE3F22746EB8234 A6EA58BE63FFBD21BD69C19F7F87DA312A122C7FC9B0B2FE2A44AF7A4109A270451BBA7C9E1F67C78C320A223AC27D034E5889B3EAB859E0F349FFE44C17 A20736008B1BD07D1B6FC1F694943EC835B71101C2970B7A4544A901D93DEDDBFAC7A53D2C656E2706246350896603FC04D062101C2CCF70D2FADA41309C 50C6A97C1039A9C7B199F48B0101 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED! YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMENANTLY DESTROY YOUR FILE. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE SOLUTION TO YOUR PROBLEM. WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER. YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES BACK. Contact us for price and get decryption software. http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-n5bVa3TID45ZZJYxFsl56gjHgRHJugtQ * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". 4. Start a chat and follow the further instructions. If you can't use the above link, use the email: [email protected] [email protected] MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

URLs

http://gvlay6u4g53rxdi5.onion/18-Ki2twEY3dSB8H6tq1bQEXq3jjG1DmIUa-n5bVa3TID45ZZJYxFsl56gjHgRHJugtQ

Targets

- Target
  9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e.exe
- Size 895KB
- SHA256 9814f9d8a8b129d745d74d3069da69aaf4187146327cb615108e9ed1b5d3c58e
- MD5 4536297338323c00783fdceabf8d36bf
- SHA1 7ad1bf03b480ebd2b85b2bc5be4b9140b0ce6d4d
- SHA512 1d416a6057b6eb228a09b0865741e1a203c795a9e6da98c4a7318c38aa4c5de086619177434034e11996d5e4a3856e3b0d6cea33a888ef7d02d06474ed9d7582
- SSDEEP 24576:cpujQRfL2Zsfeik9HV+Ovkd4pBWLv01oqc1cTfOAf:cpbDYIk91/pIL0cYf
- TLSH
  T1F1151212B0C38477D2A12535063DB5708AB9FE300E39DB9B7BC8C26B5E1A5D1EB39706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan
- Family: MedusaLocker
  Ransomware with several variants first seen in September 2019.
  ransomware medusalocker
- MedusaLocker payload
- UAC bypass
  defense_evasion trojan
- Renames multiple (145) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1