MedusaLocker Ransomware: An In-Depth Technical Analysis and Prevention Strategies

Estimated reading time: 5 minutes

Our recent research has highlighted the presence of the MedusaLocker ransomware, which first surfaced in mid-2019. Its primary targets are the Hospital and Healthcare industries. MedusaLocker employs AES and RSA encryption techniques to encrypt victims’ data.

Technical analysis

At the start, it performs a check for the presence of a Mutex. If the Mutex does not exist, it proceeds to create the Mutex using the CreateMutexW() function, as shown in the below fig:

Fig: Creating …

aes analysis check data encrypt encryption healthcare healthcare industries hospital industries medusalocker presence prevention ransomware research rsa rsa encryption start strategies technical technical analysis techniques