General
-
Target
b90a7122ef145d6f5614e2abf23823021fd1d567180c33ff3498f0682f7eb3cb
-
Size
56KB
-
Sample
220211-hcpfzsbhb4
-
MD5
839b30a340e8a29a3c559b5edac0e1ed
-
SHA1
5189cf40248c1af99120e5650947929b7582ab4c
-
SHA256
b90a7122ef145d6f5614e2abf23823021fd1d567180c33ff3498f0682f7eb3cb
-
SHA512
97b84b854ab96dfceeb11ac9eba0258e2a07358ebf506da7518a22f14e6b782b221029f77687d67147142867d3ae5189541da9cdd0834c2894c75429c8a93b19
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������89 2D B3 76 EC 86 64 3D 0B B8 07 02 D0 49 0D A9
4B C4 B0 04 07 EC 30 3B 99 26 B0 F4 7E CE 08 55
78 63 65 B3 A5 E8 A7 D9 6E 70 A8 EF A2 62 26 82
BB FD 13 12 55 AE 9E A4 10 64 C9 C8 8D 34 A8 61
9F 8E F9 47 EC C4 CA 1C 9B 49 A0 3C B5 B6 58 DD
BB 84 A7 F5 0E F8 E7 2C B2 1D 9F 64 3F 1F 6E C2
6D 3B DD 34 82 03 19 9A D0 B4 B0 F6 81 7C 79 CF
B1 31 6C E4 69 5A 9C 71 49 93 A0 72 21 B2 75 B7
93 1C 88 29 29 53 72 A9 28 74 96 9E C0 88 40 4A
A1 56 BD D5 18 FA 19 1D AF D9 EF 58 D1 A7 4F 2B
DD 40 6E 73 C8 41 CA B1 8A 00 2F A0 F0 74 95 78
6A 18 FF BF EB 22 12 E1 05 A1 47 B2 F7 4F 24 7F
BA 87 6A 37 96 94 74 B9 E8 2B A8 AA AA C6 02 CF
F0 47 F9 D2 52 3E 01 D8 2A 29 10 57 D9 A8 ED 07
8E 52 B7 67 B4 B2 FC 75 DE 5B 23 F6 6D AF 60 5B
1B A9 C9 84 6A B6 3F EF 77 F1 EE D2 8D DC 30 42
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your corporate network locked! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
<h3>To restore files you will need a decryptor!</h3>
<center>To get the decryptor you should:</center></br>
<center>Pay for decrypt your network - 5 BTC </center></br>
<div align="left"> <strong>Buy BTC on one of these sites</strong> </div>
<div align="left">
<ol>
<li><strong>https://localbitcoins.com</strong></li>
<li><strong>https://www.coinbase.com</strong></li>
<li><strong>https://xchange.cc</strong></li>
</ol>
</div>
<div align="left">
<h1><br>
</h1>
</div>
<div align="left">
✔ Bitcoin adress for pay: 1J4c1jQy13jJegPtfpEyQb3pqSXo41Mad2
<center> </center></br>
✔ Send 5 BTC for decrypt
<center> </center></br>
✔ Send screenshot of payment to [email protected] or [email protected] - In letter
include your personal ID (look at beginning of this document)
<center> </center></br>
<center>-----------------------------------------------------------------------------
</center></br>
<center> Attention!</center></br>
<ul>
<li> 5 BTC this is price for all PC/Servers in your corporate NetWork !
<li> Only our team can decrypt your files.</li>
<li> No Payment = No decryption!</li>
<li> You really get decryptor after payment. As a guarantee you can send 1 test
image or text file to our email (In letter include your personal ID)</li>
<li> Do not attempt to remove program or run any anti-virus tools! This doesn't
help ☺ </li>
<li> Decoders of other users are not compatible with your data, because each user's
have unique encryption key!!!</li>
<li> Attempts of self-decrypting files will result in loss of your data </li>
<center> </center></br>
<center> </center></br>
<center> </center></br>
<center> © 2018 Globeimposter 2.0 | All Rights Reserved.</center></br>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�������������
Wallets
1J4c1jQy13jJegPtfpEyQb3pqSXo41Mad2
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������29 E6 17 52 F6 17 0F E8 E4 6D 9F F9 01 F3 B2 93
55 46 0C 74 AE 6D 99 BA 6D 4C 8E DE 65 2C 73 72
24 11 19 55 47 C1 D8 AC 43 34 23 58 68 BA 4D DD
16 4D 58 11 8B 55 B0 92 4A 11 D1 E6 10 15 66 C6
E7 FA 43 70 1E B1 F3 8D 15 51 58 50 42 8A 4B F0
DF 0F B0 54 65 D3 DC A7 06 B1 A9 33 BA 24 CD 3E
B6 61 C7 08 FB 71 77 19 5A BB E3 96 68 2C D3 57
C0 90 D0 23 5E D6 9F AE 7A 9D 49 9F CD E8 66 6F
9C B3 6E BB F8 FF 68 C0 07 79 47 B0 6A 24 E4 72
56 E6 14 4B 3A 3D FC 68 79 B0 70 AC 63 4F E8 AF
A0 D5 9B D9 3E 03 D4 01 1F CC 66 B5 20 82 33 BF
E2 BD 87 F1 32 14 BB 65 1D BF 80 D8 AD A7 4D 5A
0C 20 E2 5E FA 52 B3 86 2E C7 80 E1 4A DF 63 8C
29 88 7B 08 B7 D8 4A 8F 57 06 42 20 1F 4C CB 83
8D 2B 76 B4 AE 4F 15 0F 92 10 D3 7D B9 87 E2 94
5E 65 C1 A3 BF D9 5C 84 7B 7B E6 DD 84 20 0A 64
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your corporate network locked! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
<h3>To restore files you will need a decryptor!</h3>
<center>To get the decryptor you should:</center></br>
<center>Pay for decrypt your network - 5 BTC </center></br>
<div align="left"> <strong>Buy BTC on one of these sites</strong> </div>
<div align="left">
<ol>
<li><strong>https://localbitcoins.com</strong></li>
<li><strong>https://www.coinbase.com</strong></li>
<li><strong>https://xchange.cc</strong></li>
</ol>
</div>
<div align="left">
<h1><br>
</h1>
</div>
<div align="left">
✔ Bitcoin adress for pay: 1J4c1jQy13jJegPtfpEyQb3pqSXo41Mad2
<center> </center></br>
✔ Send 5 BTC for decrypt
<center> </center></br>
✔ Send screenshot of payment to [email protected] or [email protected] - In letter
include your personal ID (look at beginning of this document)
<center> </center></br>
<center>-----------------------------------------------------------------------------
</center></br>
<center> Attention!</center></br>
<ul>
<li> 5 BTC this is price for all PC/Servers in your corporate NetWork !
<li> Only our team can decrypt your files.</li>
<li> No Payment = No decryption!</li>
<li> You really get decryptor after payment. As a guarantee you can send 1 test
image or text file to our email (In letter include your personal ID)</li>
<li> Do not attempt to remove program or run any anti-virus tools! This doesn't
help ☺ </li>
<li> Decoders of other users are not compatible with your data, because each user's
have unique encryption key!!!</li>
<li> Attempts of self-decrypting files will result in loss of your data </li>
<center> </center></br>
<center> </center></br>
<center> </center></br>
<center> © 2018 Globeimposter 2.0 | All Rights Reserved.</center></br>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�������������
Wallets
1J4c1jQy13jJegPtfpEyQb3pqSXo41Mad2
Targets
-
-
Target
b90a7122ef145d6f5614e2abf23823021fd1d567180c33ff3498f0682f7eb3cb
-
Size
56KB
-
MD5
839b30a340e8a29a3c559b5edac0e1ed
-
SHA1
5189cf40248c1af99120e5650947929b7582ab4c
-
SHA256
b90a7122ef145d6f5614e2abf23823021fd1d567180c33ff3498f0682f7eb3cb
-
SHA512
97b84b854ab96dfceeb11ac9eba0258e2a07358ebf506da7518a22f14e6b782b221029f77687d67147142867d3ae5189541da9cdd0834c2894c75429c8a93b19
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-