Overview

overview

10

Static

static

59d76bbddb...2e.exe

windows7_x64

10

59d76bbddb...2e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59d76bbddbfa08a08162aae67c6ed8495cd43930b548135446f91bc453210b2e

  • Size

    50KB

  • Sample

    220211-hn1y6adfhj

  • MD5

    0bc2df9d62ad6ae0ef7ede06857a1c99

  • SHA1

    6f7d15ee94d93f85b682b2efd4065481bf0a2eba

  • SHA256

    59d76bbddbfa08a08162aae67c6ed8495cd43930b548135446f91bc453210b2e

  • SHA512

    1d1e25ec53e7863187d8df8a0d0c152e1c3e7bc35cc4859e23f96f56bdc0c12e9ac40145b1c2dda22420cda1dc779732e898846acc9a054904f524045e05b804

Score
10/10
globeimposterpersistenceransomware

Malware Config

Targets

    • Target

      59d76bbddbfa08a08162aae67c6ed8495cd43930b548135446f91bc453210b2e

    • Size

      50KB

    • MD5

      0bc2df9d62ad6ae0ef7ede06857a1c99

    • SHA1

      6f7d15ee94d93f85b682b2efd4065481bf0a2eba

    • SHA256

      59d76bbddbfa08a08162aae67c6ed8495cd43930b548135446f91bc453210b2e

    • SHA512

      1d1e25ec53e7863187d8df8a0d0c152e1c3e7bc35cc4859e23f96f56bdc0c12e9ac40145b1c2dda22420cda1dc779732e898846acc9a054904f524045e05b804

    Score
    10/10
    globeimposterpersistenceransomware

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks