globeimposter

General

Target

491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7
Size

50KB
Sample

220211-hrx2nsdgck
MD5

656ee1e1c5e105e256835db00b7c6e2d
SHA1

6f5340a175ea4b285787b38575a0073cd30af79f
SHA256

491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7
SHA512

30f22b2fd87e8fee932fc435762d210afb5cec1b694782f874d893da230f838e45e633999a1cc503b68816ca5f811d06685f2c050bf7a2da68eb23bfcbe74806

Score

10^/10

Malware Config

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��31 A5 CD 59 D8 F2 14 83 52 1C 53 9F 91 D7 1F 6F E7 FF 1B 35 7F A2 33 C4 11 3A B7 DF 98 79 B0 29 A8 A0 92 A2 4A E5 E3 B9 16 2F 64 9C 66 91 B4 BC B6 CC B4 56 F0 67 E0 BE BD B2 D8 3A E9 32 8B 1E 39 48 A8 D2 68 DD 0B DD 2A 23 F3 7C DF 2F FF C3 BA AA B5 F5 BE 2F D4 C2 6A 8C 61 9E 79 02 B3 4D E9 98 86 9E 0A E0 4E 35 9D 9C 4E 7A 14 8F E9 93 DB 44 6F A8 AD 20 12 5D DD 45 AA C3 2B EC 93 12 1F C6 2D 42 68 E5 B7 F0 4B 30 D6 62 A0 BE 53 36 1E 2D C3 5C B7 42 6E 61 5C 35 EB 56 EE FB E9 A9 FD ED 84 2C 5D FA AF BA 31 03 C4 30 12 1E 33 BE 4C C8 43 59 36 00 F2 62 DF D2 40 26 00 50 26 AB 2F B3 8A 95 2F 2E A7 2D EE 0C EA 25 85 D3 DB CD DE 9E 74 91 05 1B 2D 2E 79 FD 94 34 95 79 AA 14 59 58 65 18 65 B7 40 4E 3E AC 22 62 5F 3A B4 A3 C7 84 8C D4 79 3E EC 06 87 22 DE B6 7B 77 86 6D ��

Emails

[email protected]

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��2E FD 7A 10 2F 53 E1 36 C0 86 B3 EA A4 6B C8 A6 1E 53 8A 79 5B C3 F6 44 1F BD 6C 59 43 8D B3 8D 8D 5E 54 7F F0 C7 E2 B4 A6 D7 97 78 50 7B 65 23 77 B8 7E FC 63 08 B7 C0 78 92 59 1A 36 DD 8D DF 6D 61 23 2C 12 73 A5 E5 8C 38 76 2F F8 2E 72 90 A9 03 C8 C4 1D 75 1E 1D CE 52 42 F4 F2 74 35 5E 8C 15 FC 6C 3A DE 7D 1B 1F B1 E7 16 4F 21 C6 CA CF F1 C7 A2 C5 E4 33 AF 11 9E 51 11 E9 77 BE 54 CE F3 3D 5D 0B BF 20 8A 97 98 32 A4 ED 23 BC 14 EF 7F 3B E3 19 30 87 DB 31 D2 7F 89 B2 19 58 BF D9 14 E3 84 29 12 D1 2D CF 1E 70 E8 74 D4 28 D5 D3 42 0A 64 6D 65 5C 73 A2 0F 7E 2B C6 C8 84 6B 5A EC F7 E5 60 8F 51 9C BF 2B BA 6F D0 E9 66 45 D8 83 7A 3E B6 A5 49 BC 40 47 59 10 A6 E9 7D 66 C7 EA 9C 44 7C 0D 12 44 44 56 F3 7F 87 67 09 0F CD 89 10 68 D5 0F 9B C5 A5 26 17 76 C7 12 E8 AA ��

Emails

[email protected]

Targets

- Target
  
  491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7
- Size
  
  50KB
- MD5
  
  656ee1e1c5e105e256835db00b7c6e2d
- SHA1
  
  6f5340a175ea4b285787b38575a0073cd30af79f
- SHA256
  
  491682e4990a7cca7b5ea6d82fe56cb030023a5a497a9a73a733ac89ea5c68c7
- SHA512
  
  30f22b2fd87e8fee932fc435762d210afb5cec1b694782f874d893da230f838e45e633999a1cc503b68816ca5f811d06685f2c050bf7a2da68eb23bfcbe74806
Score

10^/10

globeimposter persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Suspicious use of NtCreateProcessExOtherParentProcess
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2