globeimposter

General

Target

a5880b76fca3e1f13356bdfde1cd2b8b3e6d316f068a593c3776f60e96e3da8a
Size

50KB
Sample

220211-he5wrabhd7
MD5

c120f323c78d046c991f0efe45f3819c
SHA1

c6cbf8dd6dda8388a6b5860a62091808e2b4d2bf
SHA256

a5880b76fca3e1f13356bdfde1cd2b8b3e6d316f068a593c3776f60e96e3da8a
SHA512

16257e1d3ef1968586b345e7d16a15a926504133a4779988f9d58d423fc0887f47e9d9e2fe050d746700a889bc3e6eaaaf8099d665dd8245b09e777bf5c7d2c0

Score

10^/10

Malware Config

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��76 59 21 5F C9 EE DF E7 62 4C 13 FE BD 42 D6 A1 B4 33 43 48 84 0B 85 47 6C 8C 86 C7 D6 6E 06 43 0E 33 E6 C8 2A 02 E8 6E C7 BA 6E B5 25 D9 33 19 8C B5 72 27 F3 87 05 56 8F D4 63 9E D8 85 A0 64 BB 65 2C EC 93 B4 9A A3 70 29 E3 82 CF 15 AC E2 35 8F 25 2D 85 C8 8F 73 CE FE AF A9 92 66 D7 87 09 18 EA 47 75 47 27 25 EA 71 14 81 E0 60 3D 87 34 0D 88 3B 71 E3 C4 A2 54 CE 0E F7 22 95 B2 72 26 13 20 86 4A AD ED A3 AD F3 52 62 01 93 11 68 14 5C 2B 3C 95 2F DF 2F 00 E5 8A CB 23 4D D2 D6 E2 C4 B4 A6 9C 12 42 C7 9C 63 F5 5E FB 24 28 2E 1C 81 EC 95 4C 91 F1 06 6B A4 76 51 A5 72 90 A2 6D AA A3 39 11 14 9C 41 0D B0 08 E9 3A D8 0F E3 D1 7B 03 11 E3 15 44 03 9C D6 36 8F D3 5C 76 38 AE C6 2F 10 93 52 B4 17 FE 70 6A A0 52 62 E5 C2 84 4B F9 31 E3 21 0C D0 03 BF F3 3C 87 12 2A D8 ��

Emails

[email protected]

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��77 90 B5 BB 77 EB D5 96 5F 55 DF 17 6D 46 CD 62 28 A0 87 C4 0C 3F 98 19 32 47 DC 72 4E 36 CC 00 C4 D4 D1 F6 6F AD A6 72 72 0C 84 6A F7 56 7B D4 6E 1E 90 5C 00 BB 47 A0 54 F7 1B F1 19 20 F6 20 E7 59 2A 4C D8 C2 BE AD 06 D4 EE FF 25 ED 2D C7 1C 5A 32 54 C6 8C 73 CC 18 23 96 06 5C AC D5 6D 64 5D 53 CC CF EB F2 14 BB 3A 76 C4 6D 9A 60 AD 1E 00 48 7F E0 9E 42 9B 77 65 52 51 17 BD EA F0 60 98 8B CE BF 58 09 51 C3 CE F1 C0 1D EC 7F 6B A6 CF 13 64 B4 15 08 AC 74 C5 07 1E 9B 65 42 F4 65 B1 0B 29 E6 B1 DE 9D 07 30 F6 3D FD 02 EC 05 B9 A7 29 98 0E A8 5F EE 3C 2B 53 02 FA F6 61 72 43 DC 8D A3 9D 6E B6 9B AC 34 90 20 DC 77 7E E9 5C 7F 54 30 B4 AE EE 84 64 9D 22 D8 7C 5C 4D 57 6B E0 67 50 F4 B0 44 5D 3B 72 2F D2 15 D2 C0 9B CE 95 F4 8A 12 CC 67 C7 AF 0A 9B 37 78 C5 72 D4 ��

Emails

[email protected]

Targets

- Target
  
  a5880b76fca3e1f13356bdfde1cd2b8b3e6d316f068a593c3776f60e96e3da8a
- Size
  
  50KB
- MD5
  
  c120f323c78d046c991f0efe45f3819c
- SHA1
  
  c6cbf8dd6dda8388a6b5860a62091808e2b4d2bf
- SHA256
  
  a5880b76fca3e1f13356bdfde1cd2b8b3e6d316f068a593c3776f60e96e3da8a
- SHA512
  
  16257e1d3ef1968586b345e7d16a15a926504133a4779988f9d58d423fc0887f47e9d9e2fe050d746700a889bc3e6eaaaf8099d665dd8245b09e777bf5c7d2c0
Score

10^/10

globeimposter persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2