General
-
Target
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
Size
54KB
-
Sample
220211-hh8rtadfbq
-
MD5
95755470bef529c0087e799f471588aa
-
SHA1
adc63f3cbf4890fea962b4b0891acccbad350668
-
SHA256
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
SHA512
f7a414c716de72c4b33910677222113931208269c2ce6c818052b1e5bf128282a47b5260497f8ec7aebfd54e219df66226f63d2ac91eb137b7eb90b5743e105e
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<br><center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.</br>
Without a secret key stored with us, the restoration of your files is impossible</h1></center>
<br><center>---------------------------------------------------------- </br></center>
You will be able to restore files so:
<li> to contact us by e-mail: <strong>
[email protected]
</strong></li>
You send your personal ID and 3 crypted files, up to 3 MB in size everyone.
We will decipher them, as proof that we can do this.
Also you receive the instruction where and how many it is necessary to pay.
<li> you pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li>
<center>---------------------------------------------------------</center>
<div class="note private">
<div class="title">Your personal ID:</div>
<pre>���������D1 F3 EF B6 50 4D D8 FB A9 86 8A CD 0B DD 20 13
81 3A CD 32 72 EF 60 8A BB 0A 82 AF B7 FB 40 64
A4 E6 98 59 95 12 B6 75 50 C0 29 93 26 5A BF FB
5D BC AC 4B 3E F4 37 04 29 BF AD 86 0C AC CB E6
3A 90 C2 2D 68 9F 73 05 32 4C BF 5D A4 A8 B9 4D
66 0D 91 41 4E FB A3 01 AF B6 43 88 D7 90 91 DD
27 26 FE 88 53 E1 10 B4 C8 02 2F 37 3F C4 06 6B
59 53 47 78 77 95 CF 18 8C 1C 6D D5 88 B4 6D 6B
8B D3 94 68 B7 1C 02 5A 9B 46 FB 6A 9C 38 2F 2F
72 66 E5 60 AD 6B 8A E7 A1 7D 76 99 A4 58 AC 4A
1D EA 11 EE 7A 24 5E 6E BE 41 C2 39 93 31 1F D5
E8 34 2B 2B 32 FD 08 8D 06 1A D2 DD D9 09 A9 77
70 A5 A4 92 3B 18 30 46 FB BC 12 87 D1 4C B2 92
1E F3 2D 2F CF E2 79 09 8B 6D 7F 46 C2 1D 51 94
4C 50 2C 44 52 16 AF 2A 54 57 A1 ED 8F 0F 2A 39
41 F2 4C E6 78 C0 3A 41 88 8C 00 AD 7F 6C CF 76
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
</body>
</html>�����������
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<br><center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.</br>
Without a secret key stored with us, the restoration of your files is impossible</h1></center>
<br><center>---------------------------------------------------------- </br></center>
You will be able to restore files so:
<li> to contact us by e-mail: <strong>
[email protected]
</strong></li>
You send your personal ID and 3 crypted files, up to 3 MB in size everyone.
We will decipher them, as proof that we can do this.
Also you receive the instruction where and how many it is necessary to pay.
<li> you pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li>
<center>---------------------------------------------------------</center>
<div class="note private">
<div class="title">Your personal ID:</div>
<pre>���������9C 32 2B 90 34 02 FA FB 21 D8 93 DF 28 8C D1 78
EC 5C 3B BC 55 3C F2 7F DF F2 66 4D 80 00 2C 36
E8 77 25 C6 A8 B0 48 D2 D0 0C 38 4D 65 70 AC B1
8E 0E E8 D7 22 8E 7C C3 2D 4E F7 C2 36 63 C1 FB
47 2F D7 EC FD 04 40 94 F6 DA B6 13 38 40 59 51
CA 5A 4D 55 22 BF 33 8F EC 4D C2 BB 4A 80 3D 68
57 29 D3 58 29 05 1B 0A 5A DB 92 48 70 25 F2 04
70 E5 ED 99 B7 AE C5 E4 87 E8 60 FC F3 46 BC 3D
BA 8D 0B AB 4F 2C 01 AB 6D F4 19 87 68 9E D3 F3
CD 9B 9A 39 F8 45 2F D1 11 B9 34 14 71 6B 84 C6
8E BE 05 BE 2A DF 24 6A 2F EC AB E6 FF DF 0E C8
0F 3C C4 A3 7E CA 13 07 89 FD AA E0 66 35 64 2F
D8 76 DA 2C E1 A1 58 4A 9C 5D 5C 1D 50 E7 02 AD
AF 74 2A AE FB 99 E7 89 11 45 1E 96 04 B8 E7 19
EC 28 11 CE 0C B5 68 5C 0D E3 F8 56 15 81 C5 20
E1 1F 64 4B B6 ED 81 28 2A 02 8D 90 78 BF B5 CD
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
</body>
</html>�����������
Targets
-
-
Target
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
Size
54KB
-
MD5
95755470bef529c0087e799f471588aa
-
SHA1
adc63f3cbf4890fea962b4b0891acccbad350668
-
SHA256
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
SHA512
f7a414c716de72c4b33910677222113931208269c2ce6c818052b1e5bf128282a47b5260497f8ec7aebfd54e219df66226f63d2ac91eb137b7eb90b5743e105e
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-