General
-
Target
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
Size
115KB
-
Sample
220211-hc3zdabhb5
-
MD5
ea469ffdeb5e04efbc225017500f4d4c
-
SHA1
bde1e9e537081757c864d2ad50007bf1cb928849
-
SHA256
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
SHA512
487d419811a2aec7e5b3a154590d696eb7e2626f014ebea5feaa7c50bf4b0f276d860243c5bcf5e380a8f97232b5a595a6a1dc434dd55cc395389c915bcda94f
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="windows-1251">
<title>HOW TO DECRYPT YOUR FILES</title>
<HTA:APPLICATION
ICON="UserAccountControlSettings.exe"
/>
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">All your files have been encrypted!</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>�53 B3 D2 B0 AD D3 22 8D A8 C1 54 41 EA 14 A1 67
3C 56 26 8A 65 49 05 0E 71 AE D3 19 4E 65 02 06
87 79 68 48 B9 D4 5E 5F D1 75 79 95 DC A6 9C 1E
5E 6C 27 44 92 C1 8E 6B 2A 2C A1 6A 7F A6 AB BF
52 FB 57 44 D4 DE AE 89 E4 39 11 8E 0D C4 BB 7A
5A 8B FB 98 FC C4 6F 5E 93 03 BB 58 BE 0B 0A 15
70 C0 B2 23 34 A8 88 AB C7 0A CE 4D 1C FD B2 BA
9E 0D 00 6E 61 D1 B7 C9 92 EC 8E EF 33 92 96 82
56 EC 18 50 3E E5 5C 4A 83 1A 7C D9 38 AD 7F 24
9F 32 61 DA 44 08 1F FA BC E6 48 71 D1 DD C6 79
00 16 E8 DF E3 1B 75 DC 7C E6 57 99 E9 0A 9A 31
6E 1D 07 B5 BF EE 57 ED 87 78 6E 10 A1 3F 6A 84
92 8D DA CC 36 92 98 58 58 76 DB 9F 80 B3 81 89
2A 2C E0 F8 4D 3A E5 2B 22 25 94 1E 93 19 3D 5D
32 61 1B BE 49 70 8E EA 5B A3 8C BE 4D F5 9A B8
DD 3E D2 88 AE B4 88 5A 5D C6 E3 10 2E 58 D8 6C
</pre><!-- !!! do not change !!! -->
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mail:<font color="FF0000">[email protected]</font></div>
<div class="bold">Additional Mailing Address e-mail:<font color="FF0000">[email protected]</font></div>
<div class="note info">
<div class="title">How to obtain Bitcoins</div>
<ul>
<li>The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<li><a href="https://localbitcoins.com/buy_bitcoins">https://localbitcoins.com/buy_bitcoins</a></li>
<li>Also you can find other places to buy Bitcoins and beginners guide here:
<li><a href="http://www.coindesk.com/information/how-can-i-buy-bitcoins/">http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a></li>
</ul>
</div>
<div class="note info">
<div class="title">Free decryption as guarantee</div>
<ul>
<li>Before paying you can send to us up to 1 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 1Mb</li>
</ul>
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
</li>
</ul>
</div>
</body>
</html>�����
Emails
color="FF0000">[email protected]</font></div>
color="FF0000">[email protected]</font></div>
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="windows-1251">
<title>HOW TO DECRYPT YOUR FILES</title>
<HTA:APPLICATION
ICON="UserAccountControlSettings.exe"
/>
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">All your files have been encrypted!</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>�4C 0A B7 09 90 46 D4 FD 54 F0 95 5C 8A 24 A9 26
12 FA 56 94 52 61 91 75 D0 35 D4 97 80 39 FD 8C
A7 AC 51 BC FD 54 5E 30 DE 3D 51 1E 90 D9 52 27
6D 27 C0 D0 EA D6 0D 60 F6 9C 94 29 1A 50 FB 3D
09 8A FA 14 4C 6F DA 28 09 D6 3E 3E BC B8 E3 1B
0C A6 12 8B 9C 2B 32 7B B6 57 4D 90 FF D6 E1 B8
BB E0 4E 62 08 DE B3 A7 8E EF AC B1 8D E9 E3 9F
69 68 C8 C4 6F 4D FC 96 9F 9D 89 E8 27 F4 24 22
BC 1D 6C 66 B7 5F 44 D4 A6 44 33 74 CC 5E AF C8
89 10 5A 61 B6 39 ED D2 73 7D 42 07 6E A7 A5 EE
BF 36 91 BC 50 5E 99 E1 F9 A5 F4 10 A4 AB 2D 1F
A1 AD C9 D5 FB 0D C3 58 25 2D 59 56 84 F8 56 9B
FB 6E 74 E2 1A AC D9 56 A7 43 77 BA D2 98 4F 15
12 E8 0C 8D CC F3 BC 3A 53 1E 78 D3 58 45 78 02
28 75 A7 98 FD 96 92 59 AE 22 82 AB DD B6 58 25
C7 66 A9 A5 F3 48 DA 9C B4 45 C0 32 C9 35 08 88
</pre><!-- !!! do not change !!! -->
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mail:<font color="FF0000">[email protected]</font></div>
<div class="bold">Additional Mailing Address e-mail:<font color="FF0000">[email protected]</font></div>
<div class="note info">
<div class="title">How to obtain Bitcoins</div>
<ul>
<li>The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<li><a href="https://localbitcoins.com/buy_bitcoins">https://localbitcoins.com/buy_bitcoins</a></li>
<li>Also you can find other places to buy Bitcoins and beginners guide here:
<li><a href="http://www.coindesk.com/information/how-can-i-buy-bitcoins/">http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a></li>
</ul>
</div>
<div class="note info">
<div class="title">Free decryption as guarantee</div>
<ul>
<li>Before paying you can send to us up to 1 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 1Mb</li>
</ul>
</div>
<div class="note alert">
<div class="title">Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
</li>
</ul>
</div>
</body>
</html>�����
Emails
color="FF0000">[email protected]</font></div>
color="FF0000">[email protected]</font></div>
Targets
-
-
Target
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
Size
115KB
-
MD5
ea469ffdeb5e04efbc225017500f4d4c
-
SHA1
bde1e9e537081757c864d2ad50007bf1cb928849
-
SHA256
b59c1e665e2a6cd43c8e906239b6b5991f1205bc5298a9131384953be4a484a1
-
SHA512
487d419811a2aec7e5b3a154590d696eb7e2626f014ebea5feaa7c50bf4b0f276d860243c5bcf5e380a8f97232b5a595a6a1dc434dd55cc395389c915bcda94f
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-