███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

MedusaLocker

ransomware1 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

MedusaLocker

CATEGORY:

RANSOMWARE

DESCRIPTION:

MedusaLocker is a ransomware that has been in operation since 2019. It operates as a Ransomware-as-a-Service (RaaS) and primarily gains access to victim networks through vulnerable Remote Desktop Protocol (RDP) configurations.

TAGS:

raaswindowsrdp

[MUTEX_SIGNATURES](1)

[MUTEX_01]

8761ABBD-7F85-42EE-B272-A76179687C63

ANALYST: @adhikara13 DATE: 2025-07-16

REFERENCES:

https://cyble.com/blog/unmasking-medusalocker-ransomware/

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2019

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:1

THREAT_ACTORS:1

ALIASES:0

TAGS:3

CATEGORY:RANSOMWARE

Malware profile loaded successfully