General
-
Target
d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
-
Size
55KB
-
Sample
220211-g94rhabgg7
-
MD5
6af267d388242b54a87d0d0b6eb0ccd8
-
SHA1
eeeec084ebf73ca9d6600452e2997a469b4996c9
-
SHA256
d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
-
SHA512
270e9ee5ec4fd63045a8e6a704106e178bd20788b73e7e1a9e4db83eaa629b38dd55bf7a202d534c0d91a20ce76e7b21d14335f94366f4acbf8a20194cfadce2
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #303030;
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>��CB CB EA 36 3F 7B 9A DB 66 B0 8E 3D F1 35 52 03
B4 94 08 F9 43 A4 01 00 C4 81 2A 8E 65 72 83 83
03 68 94 42 78 14 66 EC 22 FA DF CC 89 35 99 19
17 B5 EF 52 97 F4 67 B6 E5 F2 A1 C9 B4 B2 7C 1F
5B B3 83 8B DA 4D 48 85 B8 00 B6 CB 60 A0 6E F8
59 18 11 18 97 C7 E9 E4 BD 9D 84 A6 C3 28 71 30
C5 80 09 F7 7F 60 2B C5 FA DB 51 D6 B7 88 59 20
B1 74 1C A5 A7 58 22 23 F8 04 90 94 1D 7F E8 B8
DB 77 3D 40 49 D5 7D 45 50 B5 7E 37 FE 8D 54 2E
C4 E5 64 BD B6 B7 BD 9C F2 45 8A B6 97 DA 15 C9
C1 0A 03 88 33 2C 2D ED E0 DB 87 60 2B 9F 88 70
8A D7 99 A8 AD 1C BF D4 8E F1 89 96 13 24 41 F2
29 D3 8C 7D 69 3B D9 42 94 09 6E 19 2D 7E 9B 63
7F C9 96 A6 0A 1F 6F 20 78 3B D0 F8 74 AE 73 23
F2 F7 68 53 5E 43 D9 34 CE B4 27 21 D3 87 5D 31
E8 F1 17 10 4D 53 C4 2E D3 D3 4F CA AD CA F2 12
</p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<hr/>
<h3> ⬇ To decrypt, follow the instructions below. ⬇ </h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br>
(Or alternate mail <font color="FF0000"> [email protected] </font>)<p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<hr color=red>
<center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center>
<center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services.
No one, except [email protected], will decrypt your files.</p></center>
<hr color=red>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FF0000;
background: #303030;
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>��09 5E E0 8B 96 E4 73 CD 31 7C 18 12 6C 27 67 F8
6A 20 E6 C5 EF 36 22 98 98 39 8F 35 73 96 6A 3C
5C 0B E6 AD 4F 1F C2 9B 25 04 62 50 1F A0 3E B6
23 DB F9 72 85 CD CB F9 C2 EB 22 5B FF 9A 64 BB
34 71 19 3D 09 C0 CB D0 B8 EF FB 93 6C 15 99 FB
9F DF C5 2F 19 10 9F 74 DC AF CD 98 CD A1 6D D5
E0 D4 A7 DC 08 A2 11 ED 80 48 9F FE 3B 4F 2E BA
5F 74 F7 C4 8F 54 0A 4F 8D 3F 3C 21 B3 F0 07 20
C4 23 A4 27 0A 12 FD 5C 1A 36 2E FA 6F FA BF 41
99 DC F0 74 7F 9E AD 33 7D B9 8B 09 8F 3C 8B AA
E6 5F CD B4 63 09 21 8B F9 F1 21 B5 13 A8 EA 63
04 5D 77 50 A5 A8 F3 71 0D 54 87 D4 35 B6 2E AA
B5 CB 39 86 79 03 16 1E 11 81 D5 26 2D AA 44 A5
79 AF 51 C2 F0 38 55 A5 D9 37 7A 82 67 40 20 36
45 01 B9 B0 5B 29 85 EF DD 32 BF 68 EE 25 1A EA
38 5E EB F3 30 CD 5A 5C 6C CE E2 9D 74 15 8B 60
</p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☣ Your files are encrypted! ☣</h1>
<hr/>
<h3> ⬇ To decrypt, follow the instructions below. ⬇ </h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br>
(Or alternate mail <font color="FF0000"> [email protected] </font>)<p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<hr color=red>
<center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center>
<center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services.
No one, except [email protected], will decrypt your files.</p></center>
<hr color=red>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
-
Size
55KB
-
MD5
6af267d388242b54a87d0d0b6eb0ccd8
-
SHA1
eeeec084ebf73ca9d6600452e2997a469b4996c9
-
SHA256
d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
-
SHA512
270e9ee5ec4fd63045a8e6a704106e178bd20788b73e7e1a9e4db83eaa629b38dd55bf7a202d534c0d91a20ce76e7b21d14335f94366f4acbf8a20194cfadce2
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-