MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 634d84758d8d922bbfb0ad3c904c38fc7989f11503877acf02ad5dad3775df7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MedusaLocker
Vendor detections: 13
| SHA256 hash: | 634d84758d8d922bbfb0ad3c904c38fc7989f11503877acf02ad5dad3775df7a |
|---|---|
| SHA3-384 hash: | 02d4258fab25a72be4500cb3309adbeeace26e0e27fd4c56931bf637a6ca2f546049fc9e4250ba4845d3456dc94707ae |
| SHA1 hash: | 5fff4c7c46e9d43682b3f905b67e01a666ca042d |
| MD5 hash: | adf82786199fd5014675f8b5450cce16 |
| humanhash: | iowa-massachusetts-charlie-red |
| File name: | winlogin.exe |
| Download: | download sample |
| Signature | MedusaLocker |
| File size: | 550'400 bytes |
| First seen: | 2022-02-22 17:11:23 UTC |
| Last seen: | 2022-04-19 20:48:59 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 94a05edd536770f9e1ec8c773654f3a1 (1 x MedusaLocker) |
| ssdeep | 12288:PyX/Gc6mBG6Lg9PNPjvrdY0YZa2+OeO+OeNhBBhhBBKfsDENv5c+QgMJu1sssn:PyXuc6mE609PNPjDdYpyrPguy |
| Threatray | 5'417 similar samples on MalwareBazaar |
| TLSH | T1C6C47C10F262F271D46399F44A7DAE76952C7D340B2457FB73C82A295A395C08B30FAB |
| Reporter |  r3dbU7z |
| Tags: | exe MedusaLocker Ransom Ransomware T800 |
Intelligence
File Origin
# of uploads :
6
# of downloads :
520
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://bazaar.abuse.ch/download/634d84758d8d922bbfb0ad3c904c38fc7989f11503877acf02ad5dad3775df7a/
Verdict:
Malicious activity
Analysis date:
2022-02-23 01:25:59 UTC
Tags:
ransomware medusalocker
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
MedusaLocker
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Launching a service
Creating a file
Launching a process
Creating a window
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling the 'hidden' option for recently created files
Creating a file in the Program Files subdirectories
Changing a file
Moving a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching the process to interact with network services
Deleting volume shadow copies
Encrypting user's files
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm control.exe curator evasive filecoder greyware lockcrypt medusalocker shell32.dll wmic.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
T800
Detection:
malicious
Classification:
rans.evad
Score:
84 / 100
Signature
Antivirus / Scanner detection for submitted sample
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected T800 Ransomware
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.MedusaLocker
Status:
Malicious
First seen:
2022-02-13 02:42:35 UTC
File Type:
PE (Exe)
AV detection:
36 of 43 (83.72%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
ryuk
Similar samples:
+ 5'407 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
discovery persistence ransomware
Behaviour
Delays execution with timeout.exe
Interacts with shadow copies
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Launches sc.exe
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Checks computer location settings
Deletes itself
Modifies file permissions
Modifies extensions of user files
Deletes shadow copies
Unpacked files
SH256 hash:
4b4dadbf64b847377a98a18ad25a240063935391c8dcc9169282f1e25e790a0f
MD5 hash:
33340644d3d680496d0524632bd05c5b
SHA1 hash:
0bfe4200a8c1dd52a04679f3ee38559e3d9559ec
SH256 hash:
aa60e7b5ef3cfc8de305df61666ea0881fc0e5e3393d34b23374bf3f6cd581ce
MD5 hash:
7764ad276e10a41bdf3d33903e6a676b
SHA1 hash:
07a0a10709224e11ad0d7465f325dc91e04d2e33
SH256 hash:
6d0b5ac0cc09841691adc2aaee7d1f864473002ae09c204667316983b5ec52ca
MD5 hash:
a0671df0c9ff637e3827ee2d1b7ff8cc
SHA1 hash:
051c8ab09875a1ec34b5b7bfc7810c4513f6b0a1
SH256 hash:
9ca517db34b73311b27128766ab7397cce8cf1367deffea71f146cd4db5f80ad
MD5 hash:
23b6bd08ee03687c513d0a3fce31fcc3
SHA1 hash:
01f6a92ae6631517b60db07a343c8402e30b1dcf
SH256 hash:
0377585ec50ed2e1b3d8519be272599f31024accd20b484ddae8240e09cc83b4
MD5 hash:
13d3997b43c3d5cbafb0ff10b6f0dee1
SHA1 hash:
e650a76f3fa8d28e2ff3751ccf44d124ef2b82bd
SH256 hash:
00b9c0120df0595184523a3620ef9b3c3e11fc0e61d366d7eeabb646647cfceb
MD5 hash:
bd1f243ee2140f2f6118a7754ea02a63
SHA1 hash:
cdf7dd7dd1771edcc473037af80afd7e449e30d9
SH256 hash:
634d84758d8d922bbfb0ad3c904c38fc7989f11503877acf02ad5dad3775df7a
MD5 hash:
adf82786199fd5014675f8b5450cce16
SHA1 hash:
5fff4c7c46e9d43682b3f905b67e01a666ca042d
Malware family:
Gibberish
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_GENRansomware |
|---|---|
| Author: | ditekSHen |
| Description: | detects command variations typically used by ransomware |
| Rule name: | MALWARE_Win_MedusaLocker |
|---|---|
| Author: | ditekshen |
| Description: | Detects MedusaLocker ransomware |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.