General

  • Target

    75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac

  • Size

    52KB

  • Sample

    220211-hkstdabhh6

  • MD5

    6a1eb94548ad075353d7e55826ad15a4

  • SHA1

    7719bc9194ddbfb1a496e8a15827592a5e371a14

  • SHA256

    75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac

  • SHA512

    37da482e3c71ee824c10f05d4d25ad6120e99dbf614c311c1743c108b5cce61da376709938fc1fe0cfed726568e6d071b64ffec5c22247a66dda170a4fcda9f2

Malware Config

Extracted

Path

C:\instructions.html

Ransom Note
-----BEGIN PERSONAL IDENTIFIER----- �����������B5 F8 BD F8 27 39 16 2A 9C 24 31 E8 11 E7 95 4B 0D FC 54 45 D7 53 BD E4 5D E0 87 44 6D FC 17 4D 75 58 1A 04 BA 96 27 E7 37 D6 DC DE 8E B6 E4 B2 0D 8C 21 1B B1 52 05 E1 80 FC 8C E9 8C 30 76 92 9D 09 67 A0 C4 B5 24 DE 3E DB 0A FA A3 AA 26 90 FA C8 35 4E 47 53 05 18 41 64 FB 74 77 6D 31 1B 28 03 92 05 42 A1 C6 19 FE 2A B4 39 33 17 99 83 04 BD 06 ED 52 A8 B5 BC AF 2C C3 BA 2F 0A 3C 50 F4 38 0B 38 4A E6 F3 25 F4 4F D5 BF D3 44 C2 6F 5C F0 30 66 3B 7C 6A 7D 10 47 EB 9B 9D 80 FE 85 47 EF AC 87 5E FB 0C C8 F0 94 55 22 DC EB 43 BC 18 08 F3 C5 CA A9 E7 A3 BB 9D 99 6A 2B AE 3C 28 F7 A1 D5 29 D8 20 27 55 7B 4E 5B 9E D0 4F 38 1F 38 30 C5 FC BD CC 75 08 A6 13 57 A6 D5 6F 9A D8 6C 49 44 3E 09 7D EF 5C 6F B0 EB 10 03 C6 6F 57 69 07 80 FC CE 95 55 0B 7D FB 0B A9 98 D7 6A D0 -----END PERSONAL IDENTIFIER----- All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. Files should not contain valuable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________ | | | How to obtain Bitcoins? | | | | * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click | | 'Buy bitcoins', and select the seller by payment method and price: | | https://localbitcoins.com/buy_bitcoins | | * Also you can find other places to buy Bitcoins and beginners guide here: | | http://www.coindesk.com/information/how-can-i-buy-bitcoins | | | |__________________________________________________________________________________________________| __________________________________________________________________________________________________ | | | Attention! | | | | * Do not rename encrypted files. | | * Do not try to decrypt your data using third party software, it may cause permanent data loss. | | * Do not try decryption of your files with the help of third parties. You can become a victim | | of a scam. | |__________________________________________________________________________________________________| ��������

Extracted

Path

C:\instructions.html

Ransom Note
-----BEGIN PERSONAL IDENTIFIER----- �����������5E 4E 06 15 5A 1B 58 AB 3C E9 E6 6B 13 20 C1 C4 2C FE 37 E1 FD 14 FD D0 74 BD EC 0E E5 AD DE 23 79 CF 6A A4 EE 07 D1 AF 1A 3A A1 1B BE E1 44 8B F0 1D ED A7 56 6F 5C C4 A5 A0 BE DB FE 58 AF F7 F6 53 6A A1 68 30 B6 F3 7B 31 3A B5 4C 86 A3 29 04 A5 C6 30 E9 69 61 47 97 73 D5 BC 96 4E 59 A7 27 CA DF 68 31 C1 33 11 A2 16 47 20 A6 29 61 7C 26 D2 A2 4A B1 F9 E1 A5 3F 65 77 45 18 EF 94 0C A9 8E 15 0E 7E 42 A7 AA F9 21 88 C8 B5 C0 CD 12 CF 5E 02 AB 04 C5 E5 3F 1F F2 CD E3 FF DC 82 EB BB 16 4F E8 26 C6 50 A4 8D BC C4 F3 5F E8 27 56 64 22 94 7E 35 44 CD 00 65 2B 26 93 36 AC C2 5B C0 64 DF 14 DC 52 46 30 11 7A 22 7B D1 70 06 2E 6E D4 F8 53 E4 2C CB D3 45 C6 D3 AF 1C 2D 87 A4 5C 7A 47 D2 AB 14 F7 37 1B D2 09 F4 96 17 CE EE CF 60 AD B7 E1 B8 E9 29 4E BB 71 2E 31 39 0C 7D -----END PERSONAL IDENTIFIER----- All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. Files should not contain valuable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________ | | | How to obtain Bitcoins? | | | | * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click | | 'Buy bitcoins', and select the seller by payment method and price: | | https://localbitcoins.com/buy_bitcoins | | * Also you can find other places to buy Bitcoins and beginners guide here: | | http://www.coindesk.com/information/how-can-i-buy-bitcoins | | | |__________________________________________________________________________________________________| __________________________________________________________________________________________________ | | | Attention! | | | | * Do not rename encrypted files. | | * Do not try to decrypt your data using third party software, it may cause permanent data loss. | | * Do not try decryption of your files with the help of third parties. You can become a victim | | of a scam. | |__________________________________________________________________________________________________| ��������

Targets

    • Target

      75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac

    • Size

      52KB

    • MD5

      6a1eb94548ad075353d7e55826ad15a4

    • SHA1

      7719bc9194ddbfb1a496e8a15827592a5e371a14

    • SHA256

      75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac

    • SHA512

      37da482e3c71ee824c10f05d4d25ad6120e99dbf614c311c1743c108b5cce61da376709938fc1fe0cfed726568e6d071b64ffec5c22247a66dda170a4fcda9f2

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks