General
-
Target
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875
-
Size
55KB
-
Sample
220211-hna3qsdfgn
-
MD5
9d18249b677fbc70d5d7280884ee4aba
-
SHA1
fce7f8dca532c5a7c442edd6803fdcabaa4218ca
-
SHA256
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875
-
SHA512
d71f8930081e171bb53d7b187a34b4ccf58dc00a0dd1f7d4a438b1a11cb0c362d30eb9fd7ef2ba9317d86348970e79f3552435d8fc38563cf74e9a517641ba8d
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #FFFFFF;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #FFFFFFF;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #FFFFFF;
color: #000000;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #000000;
background: #000000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #FFFFFFF;
color: #000000;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #000000;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>����������4E 89 4E AE C0 15 81 D3 87 7E 76 75 1D C3 3F 65
9D 92 40 FE B6 E1 9A DB 80 F7 4A B2 3E 60 6E 8B
40 1D 1B BA 07 75 DE 89 91 C2 75 89 58 FC 3D E0
C7 8B 55 FE 9A C4 68 13 63 DC 04 27 64 8C 11 C0
60 D5 6E 09 41 63 00 BE 58 21 5E B4 C8 1A 8F 6D
A2 5A 37 36 8A D4 71 A3 49 24 04 95 6F F0 B8 AB
0F 7B CD 94 1F BB FE 03 F1 09 1B 1F 94 9C DB 05
42 E9 AF 73 0C 7A 4C B4 3B 88 9F 2F 2F E5 19 55
E5 44 02 07 21 D8 11 6B F3 E9 EA 62 B4 6F 7E 53
D6 B5 1F 43 BE 2D 49 AC EF 19 D3 4C 47 22 C5 03
5F 1D AC 1A E3 ED 30 58 40 34 4F B0 28 9F 65 1B
09 55 61 A2 31 53 A2 81 C5 22 55 25 99 A0 FD 93
9B 02 C5 25 35 EE E2 F8 96 A2 0A B2 03 BF 65 4A
17 50 E6 70 12 7C 39 1F 6F 2A 12 3B 4B 88 95 67
AD 1C EB 0F DC D4 23 1E 5C 75 24 28 E7 D1 A8 4B
C0 28 21 7A 6D 26 C0 1A DB 61 FF B5 5D E8 69 1E
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<br/>
<div class="text">
<!--text data -->
Data recovery requires a decoder.</br>
To get the decoder, you must:</br>
<p>1. Send us an emaill:<span> [email protected] </span>.</p>
In the letter include your personal identifier (written at the beginning of this document)
and the external IP address of the device on which the encrypted files are stored.</p>
2. We will send you instructions on how to pay the decryption and after payment,
you will receive a decoder.
<p>* We can decrypt one file as evidence that we have a decoder. <br/>Send 1 test file (it must be an image or a text file)
to the email address: <span> [email protected]<span>. <br/>We will provide you with a decrypted file.<p>
3.Send a copy of the letter to the second email address: <span>[email protected]<span>
<br/>
<br/>
<center>Attention!</center> <br/>
<ul>
<li>Only we can decrypt your files</li>
<li>Do not try to uninstall the program or run antivirus tools</li>
<li>Attempts to self-decode the files will lead to the loss of your data</li>
<li>If you did not receive a response from us, check the spam or try using a different email address and email us again.</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�������
Emails
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #FFFFFF;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #FFFFFFF;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #FFFFFF;
color: #000000;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #000000;
background: #000000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #FFFFFFF;
color: #000000;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #000000;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>����������74 A3 10 61 CD 20 76 9B 66 6F 4D FB FB BF 55 D3
D3 BD 3A 40 F1 44 78 5B 2A 39 38 2A 9F A6 6A 36
BA 4E BE FE C5 A7 3B 94 F6 4B 67 4F ED D1 D6 E2
2C 24 6A D9 F9 3B CD 09 6E 07 A3 25 7B 31 4B C4
50 69 FC D9 53 C7 0D 42 94 9A E3 40 8D 9A 31 F0
2C 69 98 26 86 83 DF EF 88 4B FE 5E 01 40 9D C4
F1 6F EF C2 91 CE 11 3A 0D 13 4A 82 14 88 63 01
87 36 89 1A A2 47 3E 8C A6 4A 89 00 63 20 6A B6
38 E8 0A 99 24 FE 47 E0 F3 12 1C B8 71 27 FA 30
B2 2D 51 10 80 58 F0 82 40 16 2C 27 63 0B 75 3B
65 EC B4 3D D5 0D 2C 81 70 27 01 9A 49 DA 63 67
D4 0E 8F 53 A7 B6 6C 9F 7C 5B 93 E2 C2 0C 96 33
3A 49 1A 05 3C 34 DB FE BC 7E 79 49 B9 FC EB 46
04 7F B8 A4 3D A1 F7 F9 59 00 3C 76 DE 43 17 23
44 2E 22 C4 67 25 9C F8 B4 5D 37 47 AC 62 5D F5
58 47 72 A6 40 F1 10 D6 09 E9 67 EF 7B 74 34 72
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<br/>
<div class="text">
<!--text data -->
Data recovery requires a decoder.</br>
To get the decoder, you must:</br>
<p>1. Send us an emaill:<span> [email protected] </span>.</p>
In the letter include your personal identifier (written at the beginning of this document)
and the external IP address of the device on which the encrypted files are stored.</p>
2. We will send you instructions on how to pay the decryption and after payment,
you will receive a decoder.
<p>* We can decrypt one file as evidence that we have a decoder. <br/>Send 1 test file (it must be an image or a text file)
to the email address: <span> [email protected]<span>. <br/>We will provide you with a decrypted file.<p>
3.Send a copy of the letter to the second email address: <span>[email protected]<span>
<br/>
<br/>
<center>Attention!</center> <br/>
<ul>
<li>Only we can decrypt your files</li>
<li>Do not try to uninstall the program or run antivirus tools</li>
<li>Attempts to self-decode the files will lead to the loss of your data</li>
<li>If you did not receive a response from us, check the spam or try using a different email address and email us again.</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�������
Emails
Targets
-
-
Target
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875
-
Size
55KB
-
MD5
9d18249b677fbc70d5d7280884ee4aba
-
SHA1
fce7f8dca532c5a7c442edd6803fdcabaa4218ca
-
SHA256
5e8dd811f63242d2bbc7cfd2c276c5783f68b44c89eb3a71c117854cc0ba7875
-
SHA512
d71f8930081e171bb53d7b187a34b4ccf58dc00a0dd1f7d4a438b1a11cb0c362d30eb9fd7ef2ba9317d86348970e79f3552435d8fc38563cf74e9a517641ba8d
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-