medusalocker | 2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 716KB
Sample261114-evlahavv7k
SHA256 c28867352fdb4fcc9ed5a62dacfdc09bad51c246e89915f0ab536d7cf285269e
MD5 72ee3b1e6d71f8e9b521bf293c28d859
SHA1 f2cd566f58c4aa796d0cdc33facae67e235638b3
SHA512 0dcb23ad674df0581f62de68ca1a496ceb18de90448cdf53ffa5d992fa563b4369210020cc9380e96bc5035e4f8d87e5c58fc0a4f3f875e0c43fd141094cf691
SSDEEP 12288:CdGYbYTGaQiwEquYUWtmweCYFcph0lhSMXliJBC5k:EGT09bWzYaCh0lhSMXluBSk
TLSH
T1F8F49D25BBA540F9D1B7C139C9934907FBB2784643719BDF03A04AA21F27AE15E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware medusalocker

Malware Config

Signatures

Family: MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

Detects MedusaLocker ransomware 1 IoCs

resource	yara_rule
sample	family_medusalocker_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 716KB

2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH d6c648d67971a64e8bcd72858f8b122a
SHA256 c28867352fdb4fcc9ed5a62dacfdc09bad51c246e89915f0ab536d7cf285269e
MD5 72ee3b1e6d71f8e9b521bf293c28d859
SHA1 f2cd566f58c4aa796d0cdc33facae67e235638b3
SHA512 0dcb23ad674df0581f62de68ca1a496ceb18de90448cdf53ffa5d992fa563b4369210020cc9380e96bc5035e4f8d87e5c58fc0a4f3f875e0c43fd141094cf691
SSDEEP 12288:CdGYbYTGaQiwEquYUWtmweCYFcph0lhSMXliJBC5k:EGT09bWzYaCh0lhSMXluBSk
TLSH
T1F8F49D25BBA540F9D1B7C139C9934907FBB2784643719BDF03A04AA21F27AE15E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MedusaLocker ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

247328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

J:\edu\niggerProject\bin\Publish\locker_win_x64_encrypter.pdb

rstrtmgr

RmShutdown RmEndSession RmStartSession RmGetList RmRegisterResources

urlmon

URLDownloadToFileW

shlwapi

StrStrIW PathFindExtensionW PathFileExistsW PathIsDirectoryW PathIsUNCW PathIsNetworkPathW

crypt32

CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryW CryptStringToBinaryA

kernel32

GetDriveTypeW DeviceIoControl CreateFileA GlobalMemoryStatusEx GetComputerNameExA GetComputerNameA GetFileAttributesExW OpenProcess WideCharToMultiByte MultiByteToWideChar GetModuleHandleW FindResourceW LoadResource LockResource SizeofResource InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW GetCurrentProcess FindNextFileW FindNextVolumeW SetFileAttributesW PeekNamedPipe ReadFile GetSystemTimes FormatMessageA FormatMessageW LocalFree CreateJobObjectW SetInformationJobObject AssignProcessToJobObject HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW SetLastError FindFirstVolumeW GetLogicalDrives QueryDosDeviceW SetConsoleTitleW GetConsoleWindow GetCurrentProcessId MoveFileW lstrcmpiW CloseHandle CreatePipe FindFirstFileW GetLastError CreateFileW FindClose WaitForSingleObject WriteFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize WriteConsoleW SetEndOfFile AcquireSRWLockExclusive CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc GetLocaleInfoEx ReleaseSRWLockExclusive RtlUnwind WakeAllConditionVariable SleepConditionVariableSRW GetProcAddress GetStringTypeW TryAcquireSRWLockExclusive Sleep GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo WakeConditionVariable QueryPerformanceCounter QueryPerformanceFrequency GetCurrentDirectoryW FindFirstFileExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LoadLibraryExW LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW DeleteFileW ExitProcess GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW HeapFree

user32

GetAsyncKeyState GetWindowThreadProcessId EnumWindows ShowWindow IsWindowVisible SystemParametersInfoW FillRect GetDC GetShellWindow GetForegroundWindow

gdi32

CreateCompatibleBitmap SelectObject GetTextExtentPoint32A CreateCompatibleDC CreateFontW GetBitmapBits DeleteDC SetTextColor TextOutA SetBkMode GetObjectW DeleteObject CreateSolidBrush

advapi32

CryptEncrypt CryptGenKey CryptImportKey CryptGetKeyParam CryptExportKey CryptGenRandom CryptDestroyKey CryptReleaseContext CryptAcquireContextW GetTokenInformation OpenProcessToken RegGetValueA RegCloseKey RegCreateKeyExW RegSetValueExW RegGetValueW

shell32

SHGetFolderPathW SHGetKnownFolderPath SHEmptyRecycleBinW

ole32

CoTaskMemFree

mpr

WNetGetConnectionW

Name

.text

Size

425KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-14_72ee3b1e6d71f8e9b521bf293c28d859_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

rstrtmgr

urlmon

shlwapi

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

mpr

generic