Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
Size
54KB
-
Sample
220211-haeh1abgg9
-
MD5
f7c69ac5f5b2f6552f19acb6e712b373
-
SHA1
8ba9ab739128c7f6630f3f65fb12ca121d72afc8
-
SHA256
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
SHA512
fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #F5F5F5;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #F5F5F5;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
</head>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<div class="text">
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<div class="identi">
<strong>Your personal ID:</strong>
<pre>������������23 66 7A B6 B3 C2 AA FB 67 2C 97 91 D4 EE AC C3
4D 8C 6F 28 13 81 FD D2 42 B2 9F 1F 45 91 7D 7B
3F FB 8A 95 1F BF 06 0D E5 CB BA F8 45 75 28 1C
BD 12 8F 61 D1 8E 40 08 57 DE 25 88 B0 AF 70 6B
4C 67 C8 63 95 6D 88 6B 40 F1 9E 83 53 F0 FB E4
45 B4 9C 2A E8 5C 0A 26 3F CA 6B E1 F2 D6 3D F5
BC D7 7D 12 BC BC 1E B0 76 8E D7 3B D0 DD 87 E6
58 27 A2 51 D5 41 5F 7F 6E 61 2D 52 93 FD 49 94
AD 37 E7 2C 26 88 B5 CD B9 25 06 AD 93 47 53 D2
FB 5A EC 2E 8B F3 37 74 E4 EE 0F B5 FA 68 3C 6E
84 B7 52 CB 30 0E E3 52 97 16 69 BE F3 DB 2A F4
0A 81 89 75 08 47 94 61 0A 7B 56 69 01 DF EC B0
52 30 06 44 BE 98 1A 14 BB 26 AB 64 6A B5 F5 6C
4D 00 17 E1 61 8A 2F 65 4B B2 19 3C 2D 50 0B B5
B3 31 C4 03 8F 5E 3A 7F 8C 7B 63 6B DB 87 7C A9
0B 24 DC C1 EC 25 7B FD 3E DF 0D 96 BF 9E 38 2D
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
</div>
</div>
</div>
</body>
</html>�����
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<!DOCTYPE html>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #F5F5F5;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #F5F5F5;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
</head>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<div class="text">
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<div class="identi">
<strong>Your personal ID:</strong>
<pre>������������2D DA A6 4D 0C 33 C5 33 5B F9 C9 A8 42 01 67 CA
14 99 A0 C4 F7 F3 74 5A 1E 18 F0 AC 7A 9F F3 EC
5D C1 A8 3E 94 C9 68 0C 90 4B 16 01 A4 F1 CF BD
4E E9 28 54 6D C6 38 92 59 43 43 D2 9D 50 D6 41
1F B9 05 29 E7 D8 1F AD B7 CC 31 46 15 83 C8 B3
2A 77 2E 59 06 3F CB 4B 55 35 4B F5 CD B7 1E 6B
75 07 09 24 F8 EE DF 6C C6 C0 58 0A 1E BA 64 ED
8E 85 18 F4 A7 30 38 DF 7B 91 5E 85 DB 4C FB EC
7E CA 92 91 A5 9F 23 41 C0 BF D4 FF B3 01 B8 CB
99 CD 95 8B E3 F8 BD 5A 1D 88 BA D3 C4 46 0E F8
16 F7 77 7B 4E 1F E1 74 D8 4B 88 4D 3A 93 86 94
8F F6 D9 01 82 48 72 EA FD 1F EF 9A BF 1F 6A DE
2B 7E B4 A3 1F F4 F3 C0 21 43 F8 33 B6 D1 23 E7
1A 93 86 88 DB 13 B8 15 42 39 3B 9D 0D A0 52 A0
A8 18 F3 D3 8F F6 59 52 FC A6 28 64 A7 4B 25 FE
23 6C 21 A5 65 33 98 4B 04 ED B7 2F E5 15 D4 65
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
</div>
</div>
</div>
</body>
</html>�����
Targets
-
-
Target
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
Size
54KB
-
MD5
f7c69ac5f5b2f6552f19acb6e712b373
-
SHA1
8ba9ab739128c7f6630f3f65fb12ca121d72afc8
-
SHA256
cafb97fb68eb8af52d37d55c38d9a6b222339a7f786c20aab22b41ad51f7c97d
-
SHA512
fb044c247c8804f469ebbecc1a8f9cc58c78fe0fb6c2d97632dd552bb156cf007342351318f7c02446da442c5b009b2c49730e1743fcbe3b65965581526debed
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-