BTC $68279.0927
ETH $3629.5433
BNB $418.8260
SOL $133.0943
XRP $0.6497
stETH $3620.7348
ADA $0.7707
DOGE $0.1827
AVAX $43.0376
DOT $9.8988
wstETH $4204.4051
TRX $0.1402
LINK $20.4333
WETH $3627.8562
MATIC $1.1461
WBTC $68015.7231
UNI $12.3628
BCH $469.5171
LTC $88.8112
IMX $3.1360
ICP $13.3800
CAKE $3.3523
ETC $35.9657
FIL $10.0244
LEO $4.8744
ATOM $12.4782
TON $2.7811
HBAR $0.1174
RNDR $7.3750
KAS $0.1614
INJ $40.6866
DAI $0.9990
OKB $56.8390
VET $0.0495
PEPE $0.0000
XLM $0.1458
FDUSD $0.9965
STX $3.0333
XMR $148.4317
WEMIX $2.7041
LDO $3.2821
NEAR $4.3354
GRT $0.3080
ARB $1.9787
THETA $2.3471
APEX $2.6824
BSV $115.5449
BTC $68279.0927
ETH $3629.5433
BNB $418.8260
SOL $133.0943
XRP $0.6497
stETH $3620.7348
ADA $0.7707
DOGE $0.1827
AVAX $43.0376
DOT $9.8988
wstETH $4204.4051
TRX $0.1402
LINK $20.4333
WETH $3627.8562
MATIC $1.1461
WBTC $68015.7231
UNI $12.3628
BCH $469.5171
LTC $88.8112
IMX $3.1360
ICP $13.3800
CAKE $3.3523
ETC $35.9657
FIL $10.0244
LEO $4.8744
ATOM $12.4782
TON $2.7811
HBAR $0.1174
RNDR $7.3750
KAS $0.1614
INJ $40.6866
DAI $0.9990
OKB $56.8390
VET $0.0495
PEPE $0.0000
XLM $0.1458
FDUSD $0.9965
STX $3.0333
XMR $148.4317
WEMIX $2.7041
LDO $3.2821
NEAR $4.3354
GRT $0.3080
ARB $1.9787
THETA $2.3471
APEX $2.6824
BSV $115.5449
  • Catalog
  • Blog
  • Tor Relay
  • Jabber
  • One-Time notes
  • Temp Email
  • What is TOR?
  • We are in tor
  • The new version of Medusa first deletes user files, and only then asks for a ransom

    A new version of the Medusa DDoS botnet based on the Mirai code has been spotted in the wild (ITW) with a ransomware module and a brute force tool.

    Medusa is a type of malware that has been advertised on dark web markets since 2015. In 2017, malware acquired the ability to carry out DDoS attacks.

    Cyble said the new variant of Medusa is based on the leaked Mirai botnet source code and inherits its Linux-targeting and DDoS attack capabilities.

    Moreover, Medusa is now advertised as MaaS (malware as a service) for DDoS attacks or mining through a special portal. The malware promises stability, support, client anonymity, an easy-to-use API, and flexible pricing depending on specific needs.

    Particularly interesting in the new version of Medusa is the ransomware feature, which can encrypt certain types of files of the customer's choice. The files are encrypted using 256-bit AES encryption and have the ".medusastealer" extension appended to their name.

    It's funny that the version of Medusa, which got tested by Cyble representatives, was "broken". Since after encrypting files on the device, the malware simply turned off for 24 hours, and then deleted all encrypted data.

    It wasn't until the files were deleted that a ransom notice appeared asking for a payment of 0.5 BTC ($11,400). However, there was nothing to "redeem" anymore. An unfortunate mistake significantly affected both the earnings of hackers and their reputation. The case is really out of the ordinary. One way or another, the current state of the code makes it clear that the software is still under development.

    Even though the new version of Medusa has a data exfiltration tool, the malware does not steal user files before encryption. Instead, it focuses on collecting basic system information that helps identify victims and evaluate their computer resources, which can later be used for mining or DDoS attacks.

    The new version of Medusa also has a built-in brute force hacking program. It bruteforces credentials for devices within the network, then looks for other devices with Telnet services on port 23 and attempts to connect to them using the obtained IP addresses and combination of credentials. If successful, Medusa infects the system with the main payload ("infection_medusa_stealer"), giving attackers free rein.

    Author DeepWeb
    The developers explained the reasons for the slow and unstable work of Tor
    Grouping Nodaria uses a new infostealer in attacks on state institutions of Ukraine

    Comments 0

    Add comment