What is “Ransom.MedusaLockerCiR”?

The Ransom.MedusaLockerCiR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.MedusaLockerCiR virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Guard pages use detected – possible anti-debugging.
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• A process created a hidden window
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to delete or modify volume shadow copies
• Attempts to stop active services
• Installs itself for autorun at Windows startup
• CAPE detected the MedusaLocker malware family
• Attempts to ensure mapped drives are available from an elevated prompt or process with UAC enabled
• Creates known MedusaLocker ransomware mutexes
• Uses suspicious command line tools or Windows utilities

How to determine Ransom.MedusaLockerCiR?

File Info:
name: 753585E5E099B192CF8D.mlw
path: /opt/CAPEv2/storage/binaries/e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274
crc32: FC7B9924
md5: 753585e5e099b192cf8d7593dd5ef4bf
sha1: 68c5d6b38c9dd9e9e1e888386025352811147028
sha256: e26b2ffb2ee711fc7b04d62911580560794ee4fa9b7fcfade65ee6ff2eed0274
sha512: de96554eaa3971672f05228d26fc6cbe98c8a5b31d35b21c92256c4dfee24ec81a708d601e0be4b80a0a365f620e4b0582f6fcc950f29df2ed6233c8314494ce
ssdeep: 12288:Z764Gc6NBGBLm9PNqP9urjQ/4K/+OeO+OeNhBBhhBBlmgF6+LK2Ow1APjYHhI3xu:Z763c6NEBa9PNqP9urjQ3bO68OwOLYHG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D5D48D21F243E171D47309B44EACAEAA943D7D740B2596FB63C82B2D5A355E04E20FB7
sha3_384: a3f142a2ad79f0805b5a1c4e0d8bfc8209c6fdef08ff799b8ab4eae0710246da5d8c02266c227567e5eef71b07cb28f6
ep_bytes: e8cd040000e97afeffff836104008bc1
timestamp: 2022-05-16 14:10:39

Version Info:
0: [No Data]

Ransom.MedusaLockerCiR also known as:

How to remove Ransom.MedusaLockerCiR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.