General
-
Target
f7f3cfe5184edcc3784d81420a6cd9d938b2d60d9d549f2c758dad8aa999282b
-
Size
55KB
-
Sample
220211-g5l1wsddek
-
MD5
ad93d71be8ff2614c1344ff0f4f7ff66
-
SHA1
69709130060b6dfb33173320186eccfb74e30f85
-
SHA256
f7f3cfe5184edcc3784d81420a6cd9d938b2d60d9d549f2c758dad8aa999282b
-
SHA512
64b086a2c8cafdcd9daa06c0b3eaf3209fbacf69292dc98edaaedde8ad2ea7a34a30fb2131647833a01557020586d3128a2a19cdb374542445c482b07bdc7d1d
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
}
.mark {
background: #4A83FD;
padding: 2px 5px;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>43 AE 23 B1 77 CC 67 B8 B2 FB FB 84 F8 8A 95 9B
3F 38 C5 03 10 ED 37 A3 42 8B F6 FF 7E DD 8F 45
A5 BC 35 9A FA 82 F9 C1 04 E4 EA 88 36 0A 30 CE
74 BE 87 5D 02 84 AB A3 80 9C 74 1C 13 CA 8A C6
C8 A0 53 DB E3 32 9A 6A FC 6C B1 E7 F0 78 84 FF
70 68 6E 70 21 C6 87 08 72 47 F5 B6 4F 59 6D DB
30 11 1A A6 7A 5C 7D C0 BE 28 22 53 1A A6 41 E4
E4 FC 56 C6 B6 3E DF 94 6E 16 FD 2E 73 4F 9D 4A
3F 24 5B 66 F2 E2 D1 92 71 AF 4B AD 46 5F 31 CC
77 67 FD 1A 58 94 AA 51 3B 0D A8 8B 18 AF E7 C6
16 55 42 04 FA A5 D3 EC 3B 9F EF 42 E4 AE E8 6E
FB CF CD 93 D1 07 8B 85 92 5F 9A AF 4B 06 82 28
EE D5 2A 9A 7A 4A 12 4F 70 57 75 57 18 2B 6A 1A
24 E4 BC 3A 23 4C 97 1F FF 3E E3 DE 8E F7 C5 83
48 CD CD 83 49 E7 5F EC 34 54 3C F1 D7 58 AA A8
90 C3 6F 6D FA 48 44 D9 A9 71 AC 76 70 A5 FC BA
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span class="mark">[email protected]</span>.</br>
<p>If we do not respond within 24 hours, write to us on the second mail: <span class="mark">[email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only <span class="mark">[email protected]</span> can decrypt your files</li>
<li>Do not trust anyone <span class="mark">[email protected]</span></li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
class="mark">[email protected]</span>.</br>
class="mark">[email protected]</span>.</br>
class="mark">[email protected]</span>
class="mark">[email protected]</span></li>
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
}
.mark {
background: #4A83FD;
padding: 2px 5px;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>36 3B 76 F7 1A CC 26 03 CC 97 5E 15 D3 43 C2 B4
C5 E8 32 5B 94 97 EE 7D E8 4D 85 48 4C DF BB EE
28 09 EC A6 00 9A F8 A2 09 1B 2B 9D 32 6C 51 22
49 43 54 EA 84 E8 C1 44 F8 FC 61 5B 66 2A 80 DA
07 8B 33 83 F4 E5 71 73 B3 CC D2 1E 9F 88 7D BF
2D FB AF 57 CA 22 6C 1B C9 C8 1A 22 A7 9B DC 2E
92 36 49 C8 B8 2D 7F 07 75 7E FA 27 17 F6 67 F1
D5 05 91 F3 35 B3 B5 AE 60 5B 22 87 AC CD C5 C1
F0 40 38 A7 57 A3 F0 15 93 57 19 DA 99 B3 58 96
CF 1B 6F B2 86 17 26 7A 5C 89 1C 03 3C 56 89 BC
8D 51 7A EE E2 E6 B2 EF 6F 61 0C 2A DD 29 40 2E
95 A2 5E 36 7C 8A 15 25 51 EC 9A 16 BF 4E 89 D6
0E 88 9D 27 0F C8 5A C2 DB 2D 04 6B 05 95 3F 27
D6 50 7E E8 F9 51 F4 0E 5F D1 DA 9B 30 0D C4 B3
8D 64 E5 3C 42 36 83 6B EA 21 97 A9 D7 50 AD D3
72 BB DB 2D 26 FB 31 20 41 E1 EF 16 8B 8F 9D 54
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span class="mark">[email protected]</span>.</br>
<p>If we do not respond within 24 hours, write to us on the second mail: <span class="mark">[email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only <span class="mark">[email protected]</span> can decrypt your files</li>
<li>Do not trust anyone <span class="mark">[email protected]</span></li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
class="mark">[email protected]</span>.</br>
class="mark">[email protected]</span>.</br>
class="mark">[email protected]</span>
class="mark">[email protected]</span></li>
Targets
-
-
Target
f7f3cfe5184edcc3784d81420a6cd9d938b2d60d9d549f2c758dad8aa999282b
-
Size
55KB
-
MD5
ad93d71be8ff2614c1344ff0f4f7ff66
-
SHA1
69709130060b6dfb33173320186eccfb74e30f85
-
SHA256
f7f3cfe5184edcc3784d81420a6cd9d938b2d60d9d549f2c758dad8aa999282b
-
SHA512
64b086a2c8cafdcd9daa06c0b3eaf3209fbacf69292dc98edaaedde8ad2ea7a34a30fb2131647833a01557020586d3128a2a19cdb374542445c482b07bdc7d1d
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-