Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
A new ransomware MedusaLocker ransomware is being actively distributed and is targeting victims from all over the world. When the ransomware is installed, it will create the Registry value EnableLinkedConnections under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System registry key and set it to 1. This is done to make sure mapped drives are accessible even in a UAC launched process. It will also restart the LanmanWorkstation service in order to make sure that Windows networking is running and that mapped network drives are accessible.
It will then look for and terminate processes in order to shut down security programs and to make sure all data files are closed and accessible for encrypting. It also clears the Shadow Volume Copies so that they cannot be used to restore files, removes backups made with Windows backup, and disables the Windows automatic startup repair. It will now begin to scan the computer’s drives for files to encrypt. When encrypting files, it will skip all files that have the extensions .exe, .dll, .sys, .ini, .lnk, .rdp, .encrypted.
When encrypting files, it will use AES encryption to encrypt the file and then the AES key will be encrypted by a RSA-2048 public key included in the ransomware executable. For each file that is encrypted, it will append one of the following extensions depending on the variant of the ransomware.
.encrypted, .bomber, .boroff, .breakingbad, .locker16, .newlock, .nlocker, .skynet.
When installed, this ransomware will also copy itself to %UserProfile%\AppData\Roaming\svchostt.exe and create a scheduled task that launches the program every 30 minutes in order to remain resident. The ransom note is found in each folder having encrypted files, named HOW_TO_RECOVER_DATA.html that contains two email addresses to contact for payment instructions.
Files Encryption
From Email
sambolero[@]tutanoa[.]com rightcheck[@]cock[.]li
MD5
19ddac9782acd73f66c5fe040e86ddee
SHA256
dde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95
SHA1
24ceba1e2951cde8e41939da21c6ba3030fc531d