Overview

overview

10

Static

static

060ed35d06...0b.exe

windows7_x64

10

060ed35d06...0b.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
  • Size 54KB
  • Sample220211-h2qeksdhfm
  • SHA256 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
  • MD5 SHA1 SHA512
Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������BA A2 A5 84 CA ED 82 60 35 63 02 18 C6 EA D9 E0 05 05 8E 6A C6 E1 F0 6A 3F 8D C5 79 B2 EE 2D A5 5C 06 3D A8 6E 8C 23 77 0F 10 33 C9 7C 88 C5 BE D1 A9 AC 51 14 73 4E 24 22 FC 71 95 CE 39 52 65 61 A2 A5 60 F3 E8 3E 03 04 4E 0B 67 53 6B 47 7D 1F 37 C1 DD 89 2F DF BB 66 CF 3C 54 D6 A6 C2 35 33 67 65 C9 30 3F 3F BD BD F7 F3 60 FC D5 81 DC EE B7 A7 BA 7E 04 AE 01 A9 8A E0 E6 DA 09 AE C4 82 BB BE 8F 18 06 8C B0 C7 D6 10 C5 07 A9 7D 98 F6 49 1B CC 60 BA BC 21 0E 8E A7 48 6C 08 DB C1 32 52 1D 13 B2 B7 4E E6 FF A5 31 B8 12 78 96 32 6D DA 16 7E 81 62 D7 67 FB FD 2A 16 9D B8 64 D7 0E BD E5 9F A8 AB 73 9C 55 E0 52 92 ED DC 59 02 A0 85 6F 8F 3D C4 94 D2 97 71 5C D2 6E 8C 44 9F 1A 01 8B D4 94 8F C1 BD D2 BD 3A 17 1D 59 6E DB 81 DF 67 2D 43 10 A3 A3 7D 32 E5 A6 5A FE 61 FB </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������
Emails
URLs

  • http-equiv="Content-Type"

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������BF F3 97 13 DE D4 D1 A8 C6 C7 75 A7 92 8A 4D D3 5F EE 0C CD 2A 07 BB F4 11 4E 1A 14 5C EA DE 57 DB 91 09 73 9F 83 6F E4 0E 91 B2 8A EB 95 AB FA B4 19 04 82 DF 09 F2 26 68 B3 C4 68 34 66 A6 C3 9B 5F 4D E2 A5 0A 0E 00 64 8C 3A 93 87 4E 2F C5 18 54 D2 9D B3 D6 DD 5A 0E 2F EE 9F 0B 0A 4C AD AC BE 04 56 66 73 5E 28 1C 09 8A 26 30 B4 87 BC 14 A6 E1 5F 79 CC 1D 8F 4D 7A E5 BD D5 97 C7 70 32 89 59 39 96 3F C3 9C 50 C4 29 3D B9 35 99 BF EB 7A 46 2D F5 54 77 51 57 0C 4E 52 0F CC CE DD 2E 7A 34 BF 4D E4 17 19 B6 E2 07 80 FF E4 6F 06 1B 18 C8 2D 3B B2 8A EC B3 F8 8A E4 AC 9C 00 F0 3D 9E 2F 59 D5 22 AD 1A 3E E2 14 BF 2B 13 12 9F AC 68 DD 2D 4C A3 90 31 BA 5F D4 AF D6 46 59 83 28 05 66 86 A3 0B 7A 24 FF 93 E9 BE 7D E3 1D B9 B5 7A 2B 04 99 E3 C7 1F 4F 5B 62 25 8C 39 C1 56 </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������
Emails
URLs

  • http-equiv="Content-Type"

Targets

    • Target
      060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
    • Size 54KB
    • SHA256 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
    • MD5 SHA1 SHA512
    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks