Analysis
-
max time kernel
170s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 06:45
General
-
Target
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe
-
Size
54KB
-
MD5
95755470bef529c0087e799f471588aa
-
SHA1
adc63f3cbf4890fea962b4b0891acccbad350668
-
SHA256
81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5
-
SHA512
f7a414c716de72c4b33910677222113931208269c2ce6c818052b1e5bf128282a47b5260497f8ec7aebfd54e219df66226f63d2ac91eb137b7eb90b5743e105e
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<body>
<div class="tabs">
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<br><center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.</br>
Without a secret key stored with us, the restoration of your files is impossible</h1></center>
<br><center>---------------------------------------------------------- </br></center>
You will be able to restore files so:
<li> to contact us by e-mail: <strong>
[email protected]
</strong></li>
You send your personal ID and 3 crypted files, up to 3 MB in size everyone.
We will decipher them, as proof that we can do this.
Also you receive the instruction where and how many it is necessary to pay.
<li> you pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li>
<center>---------------------------------------------------------</center>
<div class="note private">
<div class="title">Your personal ID:</div>
<pre>���������D1 F3 EF B6 50 4D D8 FB A9 86 8A CD 0B DD 20 13
81 3A CD 32 72 EF 60 8A BB 0A 82 AF B7 FB 40 64
A4 E6 98 59 95 12 B6 75 50 C0 29 93 26 5A BF FB
5D BC AC 4B 3E F4 37 04 29 BF AD 86 0C AC CB E6
3A 90 C2 2D 68 9F 73 05 32 4C BF 5D A4 A8 B9 4D
66 0D 91 41 4E FB A3 01 AF B6 43 88 D7 90 91 DD
27 26 FE 88 53 E1 10 B4 C8 02 2F 37 3F C4 06 6B
59 53 47 78 77 95 CF 18 8C 1C 6D D5 88 B4 6D 6B
8B D3 94 68 B7 1C 02 5A 9B 46 FB 6A 9C 38 2F 2F
72 66 E5 60 AD 6B 8A E7 A1 7D 76 99 A4 58 AC 4A
1D EA 11 EE 7A 24 5E 6E BE 41 C2 39 93 31 1F D5
E8 34 2B 2B 32 FD 08 8D 06 1A D2 DD D9 09 A9 77
70 A5 A4 92 3B 18 30 46 FB BC 12 87 D1 4C B2 92
1E F3 2D 2F CF E2 79 09 8B 6D 7F 46 C2 1D 51 94
4C 50 2C 44 52 16 AF 2A 54 57 A1 ED 8F 0F 2A 39
41 F2 4C E6 78 C0 3A 41 88 8C 00 AD 7F 6C CF 76
</pre>
</div>
<center>----------------------------- P.S. ----------------------------------</center>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
</body>
</html>�����������
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe"C:\Users\Admin\AppData\Local\Temp\81e067be36ba889ed4de707129d7e1f08f2ef56270422bea03967df1ab5242b5.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB