- Home
Detectable Ransomware MedusaLocker
Ransomware Research
MedusaLocker Ransomware
MedusaLocker is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on October 1, 2019, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- MedusaLocker
- First Seen
- October 1, 2019
How MedusaLocker Ransomware Works
Targeted Files
https://www.bleepingcomputer.com/forums/t/718624/need-to-id-himynameisransom/ https://app.any.run/tasks/8c910955-d620-4498-9ea4-620df129c1cc/# https://www.bleepingcomputer.com/forums/t/710290/need-help-identifying-encryption-readinstructions-extention/ https://app.any.run/tasks/9780ceeb-6e6a-4017-8aa0-78579ea3056a/
File Encryption Patterns
MedusaLocker modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..encrypted
..bomber
..boroff
..skynet
..breakingbad
..decrypme
..ReadTheInstructions
..ReadInstructions
..networkmaze
..deadfiles
..abstergo
..himynameisransom
..VinDizelPux
..EG
..RS
..support
..spartanvladimir60@mail.ru
..divsouth
..lockfilesCO
..lockfilesKR
..1btc
..Readinstruction
..locker16
..newlock
..nlocker
..mamai10
..L41
..L47
..L54
..datalock
..L16
..farlock3
..lockfiles
..huylock
..lockfile
..frlock
..lockhyp
..youfileslock
Ransom Note and Payment Demands
After encrypting files, MedusaLocker displays ransom notes demanding payment for file recovery:
Readme.html
HOW_TO_RECOVER_DATA.html
Ransom message:
notes/HOW_TO_RECOVER_DATA.html
Note locations:
EveryFolder
HOW_TO_OPEN_FILES.html
Ransom message:
notes/HOW_TO_OPEN_FILES.html
Note locations:
EveryFolder
INSTRUCTIONS.html
Ransom message:
notes/INSTRUCTIONS.html
Note locations:
RootDiscs
UserFolders
RECOVER_INSTRUCTIONS.html
Note locations:
EveryFolder
Recovery_Instructions.html
Ransom message:
notes/Recovery_Instructions.html
Note locations:
EveryFolder
READINSTRUCTION.html
Ransom message:
notes/READINSTRUCTION.html
Note locations:
EveryFolder
INFORMATION.html
Ransom message:
notes/INFORMATION.html
Note locations:
EveryFolder
Recovery_Instructions.txt
Ransom message:
notes/Recovery_Instructions.txt
Note locations:
RootDiscs
Desktop
!!!HOW_TO_DECRYPT!!!.mht
Ransom message:
notes/!!!HOW_TO_DECRYPT!!!.mht
Note locations:
EveryFolder
How_to_back_files.html
Ransom message:
notes/How_to_back_files.html
Note locations:
EveryFolder
Technical Indicators
Associated Executable Files
The following executable files are associated with MedusaLocker ransomware:
svchostt.exe
fix.exe
dix_16.exe
dix_16_xp.exe
svhost.exe
nebuild.exe
va-1.8.exe
OP_new.exe
lr.exe.bak
2.exe
CO.exes
M10.exe
jadenzalubov
jadenzalubov.exe
svhost.exe
CRYPTED.EXE
Elastio Can Help You
Don't let MedusaLocker ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This MedusaLocker ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like MedusaLocker.
Last updated: July 30, 2025