Overview

overview

10

Static

static

034580c527...9c.exe

windows7_x64

10

034580c527...9c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    034580c52732e52a382f4d550c34f09c.exe

  • Size

    884KB

  • Sample

    220124-g8clmaddh5

  • MD5

    034580c52732e52a382f4d550c34f09c

  • SHA1

    bd4f5d3d0ca9d9d80f001666435f5d88006e75b8

  • SHA256

    185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430

  • SHA512

    300f9215a323e87d808791381bfc6e56d5fdfd8c0dcf9ceb19474e30e67557951d501da4a7a6cfdd5992450dc17bdd37144f342ab5ec9f7ec0f449e703c79074

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���24 89 9E FD 27 38 B5 08 29 18 01 5A 8B CE AC 1B DE CC F0 F8 AB F2 37 CA 2E 20 A6 4D 94 8E 68 3C 70 FD 1A 21 AF 65 EF 97 33 E3 71 1C 85 BB A8 38 0C 2F 11 F6 EA A4 1B 83 0B 88 7B BA 2A 4C 36 05 7E 84 13 59 DD CB 4E 68 30 61 7A 61 F1 3B DB C9 B8 78 A7 1B 5A DD 1E B8 CF 7C 0A 4A D4 60 CF 8D FA 5E 48 2B 2F 6F 83 8C 99 99 76 69 E5 F1 CE 4D 59 D3 23 95 A0 EE 7A FB 3E 28 8D CD 54 B2 76 B7 14 E2 42 45 EA 9A F8 62 FC 45 7E BD CE C7 75 3D 81 CD 0C 7B 16 35 28 67 A0 17 3B 2F 79 AF B2 B2 A3 04 2D 29 6E 39 49 50 3B B1 61 A8 9E 53 B0 B0 AC E6 2C E3 AD 14 1B B5 F8 BF C6 3B FC C1 79 A5 23 26 8F EB CA FE 48 02 35 D2 7B 7F 89 0F EC AD D6 9D B5 F9 9C 9B 42 18 3B 12 48 4E A9 56 FD EF 9B 9C 9E 66 D1 0F 8A E2 6E 39 A8 C6 7B 35 18 86 BE C1 97 11 D6 6F AE EC 5D 2A 06 16 CA FC BC F6
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���BE 50 B4 C0 A1 80 7D DB 2E C2 43 8C 43 3F 60 4B 3E CC ED A5 E5 C1 7E DE 73 80 AE 64 54 F4 7F AB C0 11 C5 9C 14 CF AA 35 36 B0 13 1F 66 73 35 0F 80 2D F3 FD CC 74 56 34 93 75 D3 5C B6 92 CC 52 B6 19 4D A9 7B 5B C5 C9 B8 D1 53 D7 AD CF 06 72 E1 71 24 A6 C5 F2 8F 25 6A 18 55 07 48 F7 D1 AB 65 9C F7 5A 5B 89 71 56 E4 3A 77 27 4A 61 25 02 67 17 DF E2 81 85 85 EA 59 8E FF 5E 64 47 FA 63 1A 3A E0 A1 EF 51 03 15 26 E4 F3 18 0C C4 E1 D6 9D 47 DA 62 DF 1B 40 B2 A1 A5 98 93 4E 06 FA 0D 24 89 E4 37 9E 07 24 AB 1A 6E 05 3A E0 C5 51 48 50 23 06 BC C3 43 57 28 0C 16 55 D3 01 BE 36 78 DC C9 D1 25 D7 5C F8 18 04 B2 40 20 8F 9D B1 31 87 9F 38 AB A9 62 03 64 23 83 A2 D3 BF 63 51 84 5A 65 35 39 94 4C 06 F9 2B 63 34 C8 84 53 10 34 1A 50 DD 8F DD F1 06 FC 46 44 3B 26 9E 18 64 9F
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Targets

    • Target

      034580c52732e52a382f4d550c34f09c.exe

    • Size

      884KB

    • MD5

      034580c52732e52a382f4d550c34f09c

    • SHA1

      bd4f5d3d0ca9d9d80f001666435f5d88006e75b8

    • SHA256

      185fafbeb00cd8238fdabee088763e27012dd3a0076e04dddca6266f129f0430

    • SHA512

      300f9215a323e87d808791381bfc6e56d5fdfd8c0dcf9ceb19474e30e67557951d501da4a7a6cfdd5992450dc17bdd37144f342ab5ec9f7ec0f449e703c79074

    Score
    10/10
    globeimposterpersistenceransomware

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks