{ "id": "eac64409-397c-4975-bb4d-e371a1464722", "created_at": "2026-04-06T00:21:34.386517Z", "updated_at": "2026-04-10T03:21:52.102302Z", "deleted_at": null, "sha1_hash": "367db25d814eaaaa6b164266bcd3c9e2a700a643", "title": "MedusaLocker Ransomware Wants Its Share of Your Money", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1852731, "plain_text": "MedusaLocker Ransomware Wants Its Share of Your Money\r\nBy Lawrence Abrams\r\nPublished: 2019-10-22 · Archived: 2026-04-05 23:12:58 UTC\r\nA new ransomware called MedusaLocker is being actively distributed and victims have been seen from all over the world. It\r\nis not known at this time, how the attacker is distributing the ransomware.\r\nThis new ransomware was found by MalwareHunterTeam at the end of September 2019, and while it is not currently known\r\nhow the ransomware is being distributed, there has been a steady amount of submissions to the ID Ransomware site since\r\nthen.\r\nID Ransomware submissions\r\nWhen the ransomware is installed, it will perform various startup routines in order to prep the computer for encryption.\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 1 of 7\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 2 of 7\n\nVisit Advertiser websiteGO TO PAGE\r\nIt will create the Registry value EnableLinkedConnections under the\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System registry key and set it\r\nto 1. This is done to make sure mapped drives are accessible even in a UAC launched process.\r\nIt will also restart the LanmanWorkstation service in order to make sure that Windows networking is running and that\r\nmapped network drives are accessible.\r\nIt will then look for and terminate the following processes in order to shut down security programs and to make sure all data\r\nfiles are closed and accessible for encrypting:\r\nwrapper, DefWatch, ccEvtMgr, ccSetMgr, SavRoam, sqlservr, sqlagent, sqladhlp, Culserver, RTVscan, sqlbrowser, SQLADHLP, Q\r\nwxServer.exe, wxServerView, sqlservr.exe, sqlmangr.exe, RAgui.exe, supervise.exe, Culture.exe, RTVscan.exe, Defwatch.exe,\r\nFinally, it clears the Shadow Volume Copies so that they cannot be used to restore files, removes backups made with\r\nWindows backup, and disables the Windows automatic startup repair using the following commands:\r\nvssadmin.exe Delete Shadows /All /Quiet\r\nwmic.exe SHADOWCOPY /nointeractive\r\nbcdedit.exe /set {default} recoveryenabled No\r\nbcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\r\nwbadmin DELETE SYSTEMSTATEBACKUP\r\nwbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest\r\nMedusaLocker will now begin to scan the computer's drives for files to encrypt. When encrypting files, it will skip all files\r\nthat have the extensions .exe, .dll, .sys, .ini, .lnk, .rdp, .encrypted (or other extension used for encrypted files) as well as files\r\nin the following folders.\r\nUSERPROFILE\r\nPROGRAMFILES(x86)\r\nProgramData\r\n\\AppData\r\nWINDIR\r\n\\Application Data\r\n\\Program Files\r\n\\Users\\All Users\r\n\\Windows\r\n\\intel\r\n\\nvidia\r\nWhen encrypting files, it will use AES encryption to encrypt the file and then the AES key will be encrypted by a RSA-2048\r\npublic key included in the ransomware executable.\r\nFor each file that is encrypted, it will append one of the following extensions depending on the variant of the ransomware.\r\n.encrypted, .bomber, .boroff, .breakingbad, .locker16, .newlock, .nlocker, .skynet\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 3 of 7\n\nEncrypted MedusaLocker files\r\nWhen done, the ransomware will sleep for 60 seconds and then scan the drives again for new files to encrypt.\r\nWhen installed, this ransomware will also copy itself to %UserProfile%\\AppData\\Roaming\\svchostt.exe and create a\r\nscheduled task that launches the program every 30 minutes in order to remain resident.\r\nScheduled Task for MedusaLocker\r\nIn each folder that a file is encrypted, MedusaLocker will create a ransom note named\r\nHOW_TO_RECOVER_DATA.html or Readme.html that contains two email addresses to contact for payment\r\ninstructions.\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 4 of 7\n\nMedusaLocker Ransom Note\r\nIt is not known at this time how much the attackers are demanding for a decryptor or if they actually provide one after\r\npaying.\r\nThis ransomware is still being researched, so it is not known if it can be decrypted at this time.\r\nFor now, if you have any questions or need help with this ransomware, you can leave a comment here or in our\r\nMedusaLocker Support \u0026 Help topic.\r\nUpdate 10/23/19: Correction. It started spreading towards the end of September.\r\nIOCs\r\nHashes:\r\ndde3c98b6a370fb8d1785f3134a76cb465cd663db20dffe011da57a4de37aa95\r\nAssociated Files:\r\nHOW_TO_RECOVER_DATA.html\r\n%UserProfile%\\AppData\\Roaming\\svchostt.exe\r\nC:\\Windows\\System32\\Tasks\\svchostt\r\nAssociated Registry keys:\r\nHKCU\\SOFTWARE\\Medusa\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 5 of 7\n\nHKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ \"EnableLinkedConnections\" = 1\r\nAssociated emails:\r\nsambolero@tutanoa.com\r\nrightcheck@cock.li\r\nRansom note text:\r\nAll your data are encrypted!\r\nWhat happened?\r\nYour files are encrypted, and currently unavailable.\r\nYou can check it: all files on you computer has new expansion.\r\nBy the way, everything is possible to recover (restore), but you need to buy a unique decryptor.\r\nOtherwise, you never cant return your data.\r\nFor purchasing a decryptor contact us by email:\r\nsambolero@tutanoa.com\r\nIf you will get no answer within 24 hours contact us by our alternate emails:\r\nrightcheck@cock.li\r\nWhat guarantees?\r\nIts just a business. If we do not do our work and liabilities - nobody will not cooperate with us.\r\nTo verify the possibility of the recovery of your files we can decrypted 1 file for free.\r\nAttach 1 file to the letter (no more than 10Mb). Indicate your personal ID on the letter:\r\n[id]\r\nAttention!\r\n- Attempts of change files by yourself will result in a loose of data.\r\n- Our e-mail can be blocked over time. Write now, loss of contact with us will result in a loose of data.\r\n- Use any third party software for restoring your data or antivirus solutions will result in a loose of data.\r\n- Decryptors of other users are unique and will not fit your files and use of those will result in a loose of data.\r\n- If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause ju\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 6 of 7\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nhttps://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/\r\nPage 7 of 7", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/" ], "report_names": [ "medusalocker-ransomware-wants-its-share-of-your-money" ], "threat_actors": [], "ts_created_at": 1775434894, "ts_updated_at": 1775791312, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/367db25d814eaaaa6b164266bcd3c9e2a700a643.pdf", "text": "https://archive.orkl.eu/367db25d814eaaaa6b164266bcd3c9e2a700a643.txt", "img": "https://archive.orkl.eu/367db25d814eaaaa6b164266bcd3c9e2a700a643.jpg" } }