RAN_Medusa_20260411.exe
Classification: Malicious
RAN_Medusa_20260411.exe is a ransomware (Windows executable). Detected by 59 antivirus engines. Linked to Medusa, Medusa Ransomware malware.
Detection summary
- 59 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: MEDUSA (S1220) MEDUSA RANSOMWARE (S1244)
Intrusion sets: LAZARUS GROUP (G0032)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-09-30 10:19:13 | 2026-10-16 10:12:31 | malicious-activity | |
| Medusaransomware | Triage | 2026-02-26 18:37:06 | 2026-04-11 11:19:54 | malicious-activity | S1244 Medusa Ransomware |
| Lazarus Group | MalwarePatrol | 2026-03-03 17:46:39 | 2026-03-03 18:01:01 | malicious-activity | G0032 Lazarus Group |
| Generic Malware | Hybrid-Analysis | 2026-02-26 19:45:06 | 2026-02-26 19:45:06 | ||
| Medusa | MalwareBazaar Abuse.ch | 2026-02-26 18:36:10 | 2026-02-26 18:36:10 | malicious-activity | S1220 MEDUSA |
Tags
medusaransomware credential_access defense_evasion discovery persistence ransomware spyware stealer evasive lazarus group apt38 nickel academy hidden cobra dark seoul diamond sleet dev-0139 sectora01 genie spider atk3 operation darkseoul copernicium zinc labyrinth chollima covellite unit 121 stardust chollima bureau 121 citrine sleet sapphire sleet operation applejeus ta404 andariel apt-c-26 operation ghostsecret beagleboyz g0082 group 77 whois hacking team newromanic cyber army team bluenoroff operation troy hastati group appleworm atk117 g0032 dev-1222 nickel gladstone gleaming piscesSample information
- Filenames
- RAN_Medusa_20260411.exe, gaze.exe, 15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.bin, _15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10.exe
- File type
- PE32 executable for MS Windows 6.00 (console), Int ...
- MD5
60aaafce354ae5e0b8115729464a8b24- SHA-1
53948d9596ebab5c4cf2ac04e7fb70c429e0cbbf- SHA-256
15208030eda48b3786f7d85d756d2bd6596ef0f465d9c8509a8f02c53fad9a10- SHA-512
62737b2a88919a67116e17e988f9b20d869c00d0261b2c466b571d1506977efe3819603cb0e3e48c32ae927dbb8349eb3536525852635bdb1d9273f2578ba08c- First indexed
- 2026-02-26 18:36:10
- Last updated
- 2026-08-07 03:03:22
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.MedusaLocker |
| AVG | Win32:Nukesped-II [Ransom] |
| AhnLab-V3 | Ransomware/Win.MEDUSALOCKER.C5402963 |
| Alibaba | Ransom:Win32/Medusa.091e2b93 |
| Antiy-AVL | Trojan[Ransom]/Win32.Medusa |
| Arcabit | Trojan.Generic.D4BE4E65 |
| Avast | Win32:Nukesped-II [Ransom] |
| Avira | HEUR/AGEN.1379684 |
| BitDefender | Trojan.GenericKD.79580773 |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Ransom.Medusa.S32195177 |
| CTX | exe.ransomware.medusa |
| ClamAV | Win.Ransomware.Medusa-10025438-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.42790 |
| ESET-NOD32 | Win32/Filecoder.Medusa.A trojan |
| Elastic | Windows.Ransomware.Medusa |
| Emsisoft | Trojan.GenericKD.79580773 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1379684 |
| Fortinet | W32/Filecoder.Medusa!tr.ransom |
| GData | Win32.Trojan-Ransom.MedusaLocker.A |
| Detected | |
| Ikarus | Trojan-Ransom.Medusa |
| Jiangmin | Trojan.Generic.hspyi |
| K7AntiVirus | Ransomware ( 005d78d11 ) |
| K7GW | Ransomware ( 005d78d11 ) |
| Kaspersky | HEUR:Trojan-Ransom.Win32.Generic |
| Kingsoft | Win32.Trojan-Ransom.Generic.a |
| Lionic | Trojan.Win32.Medusa.j!c |
| Malwarebytes | Ransom.Medusa |
| MaxSecure | Trojan.Malware.331166075.susgen |
| McAfeeD | ti!15208030EDA4 |
| MicroWorld-eScan | Trojan.GenericKD.79580773 |
| Microsoft | Ransom:Win32/Medusa.NKB!MTB |
| NANO-Antivirus | Trojan.Win32.Ransom.kjlpoz |
| Panda | Trj/GdSda.A |
| Rising | Ransom.Medusa!1.10015 (CLASSIC) |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | Ransom-Medusa!60AAAFCE354A |
| Sophos | Mal/Medusa-C |
| Symantec | Ransom.Medusa |
| Tencent | Malware.Win32.Gencirc.10c45d0d |
| TrellixENS | Ransom-Medusa!60AAAFCE354A |
| TrendMicro | Ransom.Win32.MEDUSA.SM |
| TrendMicro-HouseCall | Ransom.Win32.MEDUSA.SM |
| VBA32 | TrojanRansom.Medusa |
| VIPRE | Trojan.GenericKD.79580773 |
| Varist | W32/Medusa.B.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Medusa.638976.M |
| VirIT | Trojan.Win32.Genus.WEK |
| Webroot | W32.Ransomware.Gen |
| Zillya | Trojan.Filecoder.Win32.45137 |
| ZoneAlarm | Mal/Medusa-C |
| alibabacloud | Ransomware:Win/Medusa.A |
| huorong | HEUR:Ransom/LockFile.a |