MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MedusaLocker


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b
SHA3-384 hash: 7f011e94ee9caeb2f9ff02a012b499dec6e63a228e957350bc6cf843faa097a38b9bc60ba7f95b08e20c0154c59bbf10
SHA1 hash: 94ab2446ca9dd148e0f2d32247a450791b01adbe
MD5 hash: fd9b18f720c9c48d0088a00afa6bb87f
humanhash: winner-high-zulu-vegan
File name:scpvss.exe
Download: download sample
Signature MedusaLocker
Create hunting rule
File size:459'776 bytes
First seen:2022-02-22 17:06:16 UTC
Last seen:2022-02-22 19:23:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 34d3cfe59cf0e09bc867b43bab6fa814 (1 x BigLock, 1 x MedusaLocker)
ssdeep 6144:vE+MVrAQU3V1jWEaFt7Ka5ZrP0qwTA39RNxCjRp/FGyZ91DHtdTBJZEdjDMr:vE+I3UFVza5ZLMTERa7N5Z9ttdTly0r
Threatray 1'219 similar samples on MalwareBazaar
TLSH T184A45B3E76ED05F9E07BE1388D932942E6B67805033087DF0394566A1E27AF5AD3AF50
Reporter r3dbU7z
Tags:exe MedusaLocker Ransom

Intelligence

File Origin
# of uploads :
2
# of downloads :
378
Origin country :
n/a
Vendor Threat Intelligence
Detection:
MedusaLocker
Create hunting rule
Link:
https://www.capesandbox.com/analysis/243315/
Detection(s):
SecuriteInfo.com.Heur.Ransom.REntS.Gen.1.14189.28213.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP POST request
Сreating synchronization primitives
Launching a process
Launching a service
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Moving a file to the Windows subdirectory
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows directory
Deleting a recently created file
Deleting volume shadow copies
Preventing system recovery
Creating a file in the mass storage device
Encrypting user's files
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/7036/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive filecoder greyware medusalocker wmic.exe
Link:
https://www.filescan.io/uploads/6215183da2660f3bb9272511/reports/1496159b-196c-46fa-80e8-96a2982812e1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4e49b5e-1b9e-4086-b10a-05f39ce2fbcb
Result
Threat name:
T1000
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/944159
Signature
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for submitted file
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Modification of Boot Configuration
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses bcdedit to modify the Windows boot settings
Yara detected T1000 Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 576637 Sample: scpvss.exe Startdate: 22/02/2022 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Sigma detected: WannaCry Ransomware 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 7 other signatures 2->44 8 scpvss.exe 2->8         started        process3 dnsIp4 36 85.217.170.156, 49759, 49789, 80 BELCLOUDBG Cyprus 8->36 46 May disable shadow drive data (uses vssadmin) 8->46 48 Deletes shadow drive data (may be related to ransomware) 8->48 50 Uses bcdedit to modify the Windows boot settings 8->50 12 vssadmin.exe 1 8->12         started        14 WMIC.exe 1 8->14         started        16 wbadmin.exe 3 8->16         started        18 14 other processes 8->18 signatures5 process6 process7 20 conhost.exe 12->20         started        22 conhost.exe 14->22         started        24 conhost.exe 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 18->28         started        30 conhost.exe 18->30         started        32 10 other processes 18->32 process8 34 conhost.exe 20->34         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b/
Threat name:
Win64.Ransomware.MedusaLocker
Create hunting rule
Status:
Malicious
First seen:
2022-02-15 01:49:16 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqmsnjhgm6ryxvyszwh76lcvlri5p5yzvfe4tpumd52cgiiairfq._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
15d06d1741cc8b5495da9c79c6f630e33060e80c73da9666500f6f0bdf5ff259
MedusaLocker
26a4c5b36d9fde80ea47137eb53b40dacf240432a5895f98417eae51b6b681da
MedusaLocker
4e7105da7face5917f66842ba73810d29826cb971140f9da2b0efb7a37de3c0e
MedusaLocker
4fa28556557b228a0cabb6a51597217e09afdf58a140b1181f0bd8325e6e4d0f
MedusaLocker
5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95
MedusaLocker
877c612cf42d85b943010437599b828383ecdf02a17e2b017367db34637e5463
MedusaLocker
b3e1842d258c8e873289ce27144138d7b25d10a6abbe01df45a9de4dd1d34079
MedusaLocker
babf526ebe596643961a64b67dea3846f45355f4852f560046f06b633141b2a3
MedusaLocker
d7e79c2a5bc37f841e507770e28242740f3b2e076e45a4b5246ae0d1885692b8
MedusaLocker
+ 1'209 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion ransomware spyware stealer suricata
Link:
https://tria.ge/reports/220222-vmze6aceem/
Behaviour
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Deletes itself
Reads user/profile data of web browsers
Deletes System State backups
Modifies extensions of user files
Deletes shadow copies
Modifies boot configuration data using bcdedit
suricata: ET MALWARE BigLock Ransomware CnC Activity (ext)
suricata: ET MALWARE BigLock Ransomware CnC Activity (gen)
suricata: ET MALWARE BigLock Ransomware CnC Activity (id)
suricata: ET MALWARE BigLock Ransomware CnC Activity (info)
suricata: ET MALWARE BigLock Ransomware CnC Activity (name)
Unpacked files
SH256 hash:
c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b
MD5 hash:
fd9b18f720c9c48d0088a00afa6bb87f
SHA1 hash:
94ab2446ca9dd148e0f2d32247a450791b01adbe
Link:
https://www.unpac.me/results/f5f3897a-fcfc-4c99-b828-f2827a3402c1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c41926a4e667/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware
Rule name:MALWARE_Win_MedusaLocker
Create hunting rule
Author:ditekshen
Description:Detects MedusaLocker ransomware
Rule name:MALWARE_Win_Nermer
Create hunting rule
Author:ditekSHen
Description:Detects Nermer ransomware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MedusaLocker

Executable exe c41926a4e667a38bd712cd8fff2c555c51d7f719a949c9be8c1f74232100444b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/243315/

Comments