globeimposter | 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b

General

Target
060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
Size 54KB
Sample220211-h2qeksdhfm
SHA256 060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b
MD5 86de4891b15f1e5288809ad893ff83d3
SHA1 b67fffd9e2f076b2990e41f4e7bd57036f9e558c
SHA512 cb96daa8d0c76ffc43f5ec477d33f6b8544d248ba3f07ad7c09517e4694cdd14a63136102e69a06740d9b234be6533524630f3caf952c26c2c869090fde4c70c
MD5 SHA1 SHA512

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note

<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">��BA A2 A5 84 CA ED 82 60 35 63 02 18 C6 EA D9 E0 05 05 8E 6A C6 E1 F0 6A 3F 8D C5 79 B2 EE 2D A5 5C 06 3D A8 6E 8C 23 77 0F 10 33 C9 7C 88 C5 BE D1 A9 AC 51 14 73 4E 24 22 FC 71 95 CE 39 52 65 61 A2 A5 60 F3 E8 3E 03 04 4E 0B 67 53 6B 47 7D 1F 37 C1 DD 89 2F DF BB 66 CF 3C 54 D6 A6 C2 35 33 67 65 C9 30 3F 3F BD BD F7 F3 60 FC D5 81 DC EE B7 A7 BA 7E 04 AE 01 A9 8A E0 E6 DA 09 AE C4 82 BB BE 8F 18 06 8C B0 C7 D6 10 C5 07 A9 7D 98 F6 49 1B CC 60 BA BC 21 0E 8E A7 48 6C 08 DB C1 32 52 1D 13 B2 B7 4E E6 FF A5 31 B8 12 78 96 32 6D DA 16 7E 81 62 D7 67 FB FD 2A 16 9D B8 64 D7 0E BD E5 9F A8 AB 73 9C 55 E0 52 92 ED DC 59 02 A0 85 6F 8F 3D C4 94 D2 97 71 5C D2 6E 8C 44 9F 1A 01 8B D4 94 8F C1 BD D2 BD 3A 17 1D 59 6E DB 81 DF 67 2D 43 10 A3 A3 7D 32 E5 A6 5A FE 61 FB </span><p></p> </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text">  To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul>  </div> </div> </div>   </div>  </body></html>��

Emails

[email protected]</span><br>
class="letter">[email protected]</span>)</p><p>
[email protected]
[email protected]</li>

URLs

http-equiv="Content-Type"

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\GetSet.png => C:\Users\Admin\Pictures\GetSet.png.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\PushSuspend.raw => C:\Users\Admin\Pictures\PushSuspend.raw.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Pictures\RepairUnprotect.tiff	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\RepairUnprotect.tiff => C:\Users\Admin\Pictures\RepairUnprotect.tiff.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\RevokeReceive.crw => C:\Users\Admin\Pictures\RevokeReceive.crw.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\SearchWait.crw => C:\Users\Admin\Pictures\SearchWait.crw.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\StepRegister.crw => C:\Users\Admin\Pictures\StepRegister.crw.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File renamed	C:\Users\Admin\Pictures\SwitchPush.crw => C:\Users\Admin\Pictures\SwitchPush.crw.ONYX	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe

C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe
"C:\Users\Admin\AppData\Local\Temp\060ed35d067c1660b9e84451cf469e2ad1b83efcc3820f0856de7c151d0f690b.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

Analysis

Sharing