globeimposter | ac6534b3dd0663e9a617a6cd20db2ad5f6de2126e32a446af73df1c231aae5b8 | Triage

Sharing

General

Target

ac6534b3dd0663e9a617a6cd20db2ad5f6de2126e32a446af73df1c231aae5b8
Size

51KB
Sample

220211-heflvsbhd3
MD5

b5d46fd5ccf5394f219a8e86b369dd85
SHA1

1a5bed0b0c8a6cbcd74b0b4d8047a6f33fdae7dc
SHA256

ac6534b3dd0663e9a617a6cd20db2ad5f6de2126e32a446af73df1c231aae5b8
SHA512

e0c73e129d861eaa40b42492563173cb0f6042fe46f16d8c409e2074cc1a3dbceef1b7a5c6b34b274271c5e196cc6ce97e8654cdd49a5141b5a11344b6bfbf59

Score

10^/10

globeimposter persistence ransomware

Malware Config

Targets

- Target
  
  ac6534b3dd0663e9a617a6cd20db2ad5f6de2126e32a446af73df1c231aae5b8
- Size
  
  51KB
- MD5
  
  b5d46fd5ccf5394f219a8e86b369dd85
- SHA1
  
  1a5bed0b0c8a6cbcd74b0b4d8047a6f33fdae7dc
- SHA256
  
  ac6534b3dd0663e9a617a6cd20db2ad5f6de2126e32a446af73df1c231aae5b8
- SHA512
  
  e0c73e129d861eaa40b42492563173cb0f6042fe46f16d8c409e2074cc1a3dbceef1b7a5c6b34b274271c5e196cc6ce97e8654cdd49a5141b5a11344b6bfbf59
Score

10^/10

globeimposter persistence ransomware
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

globeimposterpersistenceransomware

behavioral2