Overview

overview

10

Static

static

66658b354e...7f.exe

windows7_x64

10

66658b354e...7f.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
  • Size 55KB
  • Sample220211-hmbmwacaa9
  • SHA256 66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
  • MD5 SHA1 SHA512
Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������A4 EE 7E 7C 9C 21 6F 69 F9 52 CE D4 44 76 4F F2 3D 0F 24 A0 07 EC CB 47 11 96 B0 F8 7B AC EB F0 C4 C0 79 22 6B E2 60 A4 EC BF D0 87 BF 0C CA BC 69 E9 37 01 BB C8 08 71 A3 E6 62 EA 1F D3 9B B5 D1 A5 81 9E 16 4A 83 96 31 8B FB 33 A8 78 14 9C 2F 07 21 3E 28 A0 5D DA 07 E7 68 A9 09 AD 71 58 86 53 5E D5 A6 FB 38 A3 7D 23 34 B8 58 70 6C 21 F6 FF 9C DC 5A DF F6 A0 A1 85 AB B4 7D 4E A1 9D F6 87 FD 30 A2 BF 24 2F FF C7 58 A0 76 E0 BE D0 03 1C 37 37 81 5A 4B 0F F1 D8 CA 86 70 32 DB F0 58 EA D4 D5 10 75 65 6C 8E 95 66 E9 83 6D 05 7F 16 7D 29 13 F0 91 D2 DF 4A FB 39 8C D3 38 57 A4 88 C7 CB A9 D6 A8 24 F4 EB FC 84 BC 80 37 86 04 C2 F2 6F 8B 68 23 47 14 06 24 CC 3B CD 8A FC 86 9A BE 61 59 1B DF F5 45 28 3E D2 89 3C 30 83 05 DE 7E BF 90 B1 40 9C 19 9C 05 9F 6A 2D F9 90 C4 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>How to quickly restore all files and protect data ?</h3> <div class="text"> <!--text data --> <p> Write a letter with this question to <span> [email protected]</span>.</br> We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p> In the response letter you will receive a decrypted file and a complete recovery instruction.</p> Save your time, write to <span> [email protected]</span> right now.</br> <p> </p> </br> <h3><center>Attention!</center></h3> <ul> <li>In one week all encrypted files will be destroyed.</li> <li>Only [email protected] can decrypt your files</li> <li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> <li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �����������
Emails

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������55 79 BE 10 D7 8B 81 3D C7 FD 28 42 93 AA F7 1B 42 55 B8 50 DC 83 00 54 51 B8 1B C9 F5 F6 1E 48 FF 48 8E 14 C2 3D 90 D8 E7 7D 9A 05 27 00 7B 03 AB E3 AB 5A 36 E2 19 48 32 80 63 EB 89 30 A4 8B 89 C7 80 77 44 E5 9A 3A 5E 8A 6F 5F 42 A1 BA 86 99 85 07 6D 0A 67 26 8E 55 47 35 63 8B 2F 44 60 2D E2 8F 96 2E 6A E4 4C CC DE 32 48 2D B3 19 EC DF 6A A8 57 D6 9A 53 C9 2A 62 AA 06 6F DA 55 E3 49 2B 17 5D 73 34 30 CC 32 63 F5 29 18 FE 11 F7 A1 44 04 17 6F 9C 03 1C 3E 6C EE 02 60 B7 D3 CE EB 48 26 33 7C 09 CA 9A C6 82 25 E8 EE AB AD 8F 74 50 0C 00 C4 03 77 C5 7C B8 E9 A8 F1 36 17 45 04 51 94 67 27 A1 EC 25 9D 71 4C 9A 88 84 F0 25 94 17 F3 3A D4 E4 89 29 17 9B D0 96 E7 1C 65 A2 24 12 7B 47 81 C2 30 8B 11 0B 89 DC 9E 31 C9 20 00 62 9F 34 82 EE 04 62 02 01 89 FE D1 70 FF CF </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>How to quickly restore all files and protect data ?</h3> <div class="text"> <!--text data --> <p> Write a letter with this question to <span> [email protected]</span>.</br> We really can help, make sure of this, attach to the letter an encrypted file (less than 5mb), and specify in the letter your personal ID (look at the beginning of this document).</p> In the response letter you will receive a decrypted file and a complete recovery instruction.</p> Save your time, write to <span> [email protected]</span> right now.</br> <p> </p> </br> <h3><center>Attention!</center></h3> <ul> <li>In one week all encrypted files will be destroyed.</li> <li>Only [email protected] can decrypt your files</li> <li>Attempts to self-decrypting files or run anti-virus tools will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> <li>If you have not received a response to your message for more than 12 hours, write to an alternate email address <span>[email protected]</span></li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �����������
Emails

Targets

    • Target
      66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
    • Size 55KB
    • SHA256 66658b354eb9f48c64dd7c5add4b562395cbae39f53085b08461e61f51d10d7f
    • MD5 SHA1 SHA512
    Score
    10/10
    globeimposterpersistenceransomware

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks