Analysis of MedusaLocker Ransomware
Reverse engineering of the MEDUSALOCKER ransomware to better understand how it works.
Our analysis of this MEDUSALOCKER variant shows that it uses the Chacha20 encryption algorithm to encrypt data, as well as the keys “TRUMPTRUMPTRUMPTRUMPTRUMPTRUMPTRUMP” truncated to 32 characters, then “PUTLERPUTLER” truncated to 8 characters.
We are continuing our research to understand why this ransomware gang decided to use the words TRUMP and PUTLER (which, according to some interpretations, refers to Vladimir PUTIN being compared to Hitler).
We will most likely publish another article on this subject.
