Overview

overview

10

Static

static

fb81336ee6...26.exe

windows7_x64

10

fb81336ee6...26.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb81336ee621095c2ee45675a0f51537a410ebdf08de3b04004d06b9e271db26

  • Size

    54KB

  • Sample

    220211-g4453sdddm

  • MD5

    7b3b486072cc0e27155fc0650fe4e42b

  • SHA1

    3fa908c890743e4f93f6250220bd137433198bcb

  • SHA256

    fb81336ee621095c2ee45675a0f51537a410ebdf08de3b04004d06b9e271db26

  • SHA512

    8e037694902f4ea6dadcce841fe1face23d77756f7bc0bb4af82d35a34dfc0f32a9400296672f77fdc7c62498e8bf8a07439d6427d9a359923ae16fe34051c55

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      fb81336ee621095c2ee45675a0f51537a410ebdf08de3b04004d06b9e271db26

    • Size

      54KB

    • MD5

      7b3b486072cc0e27155fc0650fe4e42b

    • SHA1

      3fa908c890743e4f93f6250220bd137433198bcb

    • SHA256

      fb81336ee621095c2ee45675a0f51537a410ebdf08de3b04004d06b9e271db26

    • SHA512

      8e037694902f4ea6dadcce841fe1face23d77756f7bc0bb4af82d35a34dfc0f32a9400296672f77fdc7c62498e8bf8a07439d6427d9a359923ae16fe34051c55

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks