March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – New LNK Attack Tied to Higaisa APT
June 5, 2020
Rewterz Threat Alert – COVID-19 Phishings Distribute GuLoader Targeting Greek Banks
June 5, 2020
Rewterz Threat Alert – New LNK Attack Tied to Higaisa APT
June 5, 2020
Rewterz Threat Alert – COVID-19 Phishings Distribute GuLoader Targeting Greek Banks
June 5, 2020
Severity
High
Analysis Summary
Medusa Locker infections begin with a batch file that creates a scheduled task. Once this scheduled task is run on startup, PowerShell is used to read a text file containing a block of malicious code. This text document contains PowerShell code capable of performing process injection. Additionally, it contained the Base64-encoded ransomware payload. After being injected into a process by the aforementioned scheduled task, the ransomware performs a large number of steps in its infection process. It checks its administrative privileges and, if necessary, performs a UAC bypass using the CMSTP technique. It establishes persistence through scheduled tasks, but instead of using schtasks.exe or at.exe like most malware, it leverages Windows programming APIs. A hardcoded list of services and processes are terminated. Additionally, during the encryption process, the ransomware performs a unique functionality of using Windows Restart Manager to unlock any files still unable to be encrypted due to a running process. WMI, vssadmin, and bcdedit are all used in conjunction to ensure recovery capabilities are prevented. Unlike other ransomware, Medusa Locker performs an additional step of emptying the Recycle Bin. After modifying SMB connection settings, the malware is also able to encrypt files on remote systems via SMB. Encryption is performed using AES-256 with a base64-encoded public key embedded inside the ransomware binary. No method to decrypt the files without paying the demanded ransom is known at this time.
Impact
File encryption
Indicators of Compromise
MD5
- c4dcfe39b3f3bbed32fbc25ed92d8fd0
- 9054555c7d931d0b5c96e9b767f4898e
SHA-256
- e6bd25aec2de3b3e5e3263768da9e20ded49f4fb9edbe34dce2df216478aeea5
- 11a044c67f6c78cb7c89bdd86c9d247fa82102d0d7f5fe035ff686447a57db31
SHA1
- 3a16925b44226d8253a14ec8c04ed46deeb7744b
- b3b4f351cc92b6f436a097d70962878c3fe04767
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.