Overview

overview

10

Static

static

e6fae4d52e...f5.exe

windows7_x64

10

e6fae4d52e...f5.exe

windows10_x64

7

Resubmissions

23/12/2021, 16:01

211223-tgmczabfel8

03/11/2021, 10:01

211103-l18fjsdee38

Sharing

Copy URL Twitter E-mail

General

  • Target
    e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5
  • Size 55KB
  • Sample211103-l18fjsdee3
  • SHA256 e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5
  • MD5 SHA1 SHA512
Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target
      e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5
    • Size 55KB
    • SHA256 e6fae4d52ed5450e44b6c16ce80abf4e63cdc25d3e4fc4f55c220cc1b740c2f5
    • MD5 SHA1 SHA512
    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks