globeimposter

General

Target

473c84be63ce9a6b112ff11480cd743dbfc945dadf9deb0fa513c0d98e0020ca
Size

50KB
Sample

220211-hsmmbsdgdj
MD5

de449996d6ecc5803a04ed8cc823a25c
SHA1

12d0e0ceb0b7cfbc47bdc85d5dc5fc6f552981c9
SHA256

473c84be63ce9a6b112ff11480cd743dbfc945dadf9deb0fa513c0d98e0020ca
SHA512

a4ea1bf400c7c7a88930f5b3d1049a450d2cc0d7626fed6c7b8f4fbaf1e4fcbb248b6740e217cffc358bfaadaa324d25819017636d065bab68c56fba186e055b

Score

10^/10

Malware Config

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��A1 C1 98 F1 9F 51 9E 36 AC E2 A3 C2 87 C4 27 28 9F F0 59 64 3E 9D 96 EE C9 86 12 56 EB E9 98 FD 6D FC 45 CE C9 94 59 FA B5 9E 36 87 AF 8F CA CC 3F 69 E9 9F 18 85 0E 0B 7E 81 48 02 7D BA 27 05 25 46 97 FA 2B 15 34 A9 F2 06 34 C9 0C B1 10 4A 65 1F 05 68 9D AB 1C 66 6A 71 36 3D 3E 4B 85 71 0E 8E 07 7F BA 42 44 CF 86 E2 9C F9 5E CE 48 C8 AE AA 2A E0 92 BA 89 20 BE 61 C2 5B E9 81 2C 0A 86 F7 EB 9B C2 F7 1B C0 31 DA EC 37 AC 7E 80 EC 50 5A 47 50 AD 0E 18 7D 7F 7F 3C CD B3 D6 23 91 BB E0 3B E7 FE 4A 62 06 FF 28 2B 96 E9 BD 53 01 F8 E0 60 91 CB 2E 95 4F EA 91 AD 69 25 D6 66 2C B6 7A 34 E1 76 0E A3 00 75 3F F6 8F F1 2D 58 EA C7 51 DA 8F 8B BD 9F 66 AA E0 4A 46 72 44 3E 76 F7 09 A6 7A E8 C1 EC 11 28 A9 9F 89 77 09 24 8C 3E E1 78 B9 DF 28 74 28 D3 7E DE DA 5B D0 67 BE ��

Emails

[email protected]

Extracted

Path

C:\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��D4 B0 48 B6 C8 4D 35 7B F1 9A 7E 18 92 26 0A AA 14 DB 59 9F CD 7F 66 4C 60 69 65 B8 38 D6 81 E3 24 20 06 AA F6 5F C4 E4 4D 70 66 2F 17 2A 0C 89 8F 5A 0F 21 89 CC 26 D9 71 B0 3F 2D 91 EB FC 6F AE 7D 89 0D 08 25 C1 EE BB 76 A3 29 95 A4 5A 08 5F 8E 17 BC 56 50 E0 94 EF 36 DF 38 71 07 AB 8F C4 6D 8E 57 0F 8D 91 C3 F3 5B FC B0 35 C3 5D EA 83 1C 71 11 9D F9 38 42 91 A6 98 28 9D 1D 4B 33 54 53 DE 8A 8C 20 52 00 66 54 47 51 4F E5 04 8E 40 02 70 99 AF 67 A0 13 87 3D C8 ED A3 4F 00 68 9D 21 39 8A 35 74 C6 6C 72 DA 1F 50 0E AA DF F9 DF 17 B3 AF 7C 20 9A C3 F9 D7 FF F3 83 D0 06 1F 28 1C FC 84 64 88 05 10 F2 EF 7D A2 62 9D C8 EB B4 28 04 B7 38 E5 1E 47 C0 C3 9F F4 11 21 AE D3 40 C8 8B D0 D5 13 4E 3A 17 A4 03 32 80 90 34 82 96 0F 2D 34 E4 2E 9E 39 78 CB 96 FE EB DA 0D AB ��

Emails

[email protected]

Targets

- Target
  
  473c84be63ce9a6b112ff11480cd743dbfc945dadf9deb0fa513c0d98e0020ca
- Size
  
  50KB
- MD5
  
  de449996d6ecc5803a04ed8cc823a25c
- SHA1
  
  12d0e0ceb0b7cfbc47bdc85d5dc5fc6f552981c9
- SHA256
  
  473c84be63ce9a6b112ff11480cd743dbfc945dadf9deb0fa513c0d98e0020ca
- SHA512
  
  a4ea1bf400c7c7a88930f5b3d1049a450d2cc0d7626fed6c7b8f4fbaf1e4fcbb248b6740e217cffc358bfaadaa324d25819017636d065bab68c56fba186e055b
Score

10^/10

globeimposter persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2