General
-
Target
3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f
-
Size
54KB
-
Sample
220211-ht8aesdgeq
-
MD5
6c360d684799cd00bb11e0331ada1027
-
SHA1
be1dae6e24bf3070de9dbf55036181796e32bb28
-
SHA256
3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f
-
SHA512
aed13d5f3a87bcbf99b760ec8bb73b6cebeb74b6f9ec188644cb998d7a5357732388d6097dbf0849180004f26ca414b420956d63cba978742553b8da2ac57cc5
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
body {
background-color: #252525;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FFD700;
background: #1C1A1B;
}
.letter {
color: #FFD700;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #1C1A1B;
color: #F1EADA;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #F1EADA;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #1C1A1B;
color: #F1EADA;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #1C1A1B;
color: #E29F12;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head"><h3>Your personal ID</h3></div>
<div class="identi">
<pre><span class="letter">�������������A4 95 88 0B 89 3B EA 07 34 5D 16 28 8D 60 D2 F6
2F 76 4F 82 4B 2A 93 7A 9B B1 E2 09 CD 42 4E 6E
B6 AC 8D DB E1 ED 87 31 65 6F 29 25 62 B9 18 BE
7B 61 FB FF F5 54 C3 CF 06 A8 D4 9C CF 98 C0 80
CC D8 FD B8 11 EB 7F BC 80 D8 55 E5 AB B4 3F B3
08 CF E4 DC 3D CD EE 40 A9 73 7B D7 E5 85 D6 E3
56 E9 69 A2 30 5E 1E F7 D0 42 25 EA 83 1D CB 47
81 F4 32 87 CE 4D 77 7A 7B B2 F8 C2 8C 00 E7 3F
AB F6 43 43 53 D2 A4 01 1F 76 03 BF 59 B2 B0 2E
87 7D 0C 3E BF 76 E0 7F 52 EE CF F3 C3 BF 64 36
A3 47 5C D3 DF 96 4E 97 34 19 89 FE 54 42 6E 82
FE 12 87 1F C2 9C 95 AB 69 51 3A D4 A4 9C 49 9D
1E F3 4A 01 2F 14 39 7D ED 84 C5 6C 7C C1 10 11
91 1B 0C 4C AA 5C EA 63 D3 A0 3B BA 1A C1 97 22
C3 51 7A 50 54 0D 53 6F E5 F1 38 49 E2 A2 3F 03
15 CF 5E 3D 51 93 41 74 E9 4E E0 AF E0 C6 C2 6D
</span><p></p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input name="tabs" checked="checked" id="tab1" type="radio">
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>? Your files are encrypted! ?</h1>
<h3> To decrypt, follow the instructions below. </h3>
<br>
<div class="text">
<!--text data -->
To recover data you need decryptor.<br>
To get the decryptor you should:<br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br>
(Or alternate mail <span class="letter">[email protected]</span>)</p><p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files<p></p>
After we send you instruction how to pay for decrypt and
after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we
have the decoder.<br>
<p>
<hr color="#FFD700">
<center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center>
<center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center>
<hr color="#FFD700">
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
<!--tab-->
</body></html>��������������
Emails
URLs
http-equiv="Content-Type"
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css">
body {
background-color: #252525;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 5px;
color: #FFD700;
background: #1C1A1B;
}
.letter {
color: #FFD700;
font-weight: 600
}
.tabs1 .identi {
margin-left: 0px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #1C1A1B;
color: #F1EADA;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #F1EADA;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #1C1A1B;
color: #F1EADA;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top:0;
background: #1C1A1B;
color: #E29F12;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head"><h3>Your personal ID</h3></div>
<div class="identi">
<pre><span class="letter">�������������65 1E B3 01 8F B5 19 31 02 A5 3F 52 FA F7 B9 BE
75 DB 11 BF 55 E5 3B F1 5B C3 36 82 62 CA 58 B2
FE 85 FA 6F AC 51 68 B6 5A 0C 56 35 16 88 0F 1A
B1 5C 56 C6 45 AE 03 CC FA 10 54 BB B6 D3 D3 2E
75 B7 6A C0 96 CE C6 7E 40 E9 FB DA C2 E7 39 E8
E7 70 93 35 53 B6 5D D2 12 73 2D 06 0A 43 93 FF
FC 83 64 71 EB C5 E7 79 86 E7 7D 59 5B EF 6A B2
C0 BF 58 86 8B FD 75 30 EF 92 B7 A0 11 75 7C 57
7F 20 EB EC D5 62 83 6A 1F 0B 9F D4 CC DA 93 84
BF C8 92 43 E4 52 F7 EF E5 7C 82 B0 C6 69 23 1A
0F 09 34 97 E6 07 0D 07 F4 3B 64 67 D1 1E D2 9E
71 A1 F0 51 7B 96 10 F0 7A FA 1B 9D C5 3F C2 2C
BD 11 31 D7 D0 04 11 6E 94 BA 87 CF F1 D9 2F 5E
55 49 48 35 49 E4 9B DC 59 5E A4 C4 0C 46 04 20
C0 AF FD 37 E8 74 32 BB BD 68 71 24 45 89 6A 3F
3D 2C 51 90 1D 81 9F AA 34 05 1A 7E 09 6F EC AF
</span><p></p>
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input name="tabs" checked="checked" id="tab1" type="radio">
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>? Your files are encrypted! ?</h1>
<h3> To decrypt, follow the instructions below. </h3>
<br>
<div class="text">
<!--text data -->
To recover data you need decryptor.<br>
To get the decryptor you should:<br>
<p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br>
(Or alternate mail <span class="letter">[email protected]</span>)</p><p>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files<p></p>
After we send you instruction how to pay for decrypt and
after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we
have the decoder.<br>
<p>
<hr color="#FFD700">
<center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center>
<center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you.
You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE.
No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center>
<hr color="#FFD700">
<ul>
<li>Only [email protected] can with a guarantee decrypt your files </li>
<li>Do not trust anyone besides [email protected]</li>
<li>Antivirus programs can delete this document and you can not contact us later.</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
<!--tab-->
</body></html>��������������
Emails
URLs
http-equiv="Content-Type"
Targets
-
-
Target
3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f
-
Size
54KB
-
MD5
6c360d684799cd00bb11e0331ada1027
-
SHA1
be1dae6e24bf3070de9dbf55036181796e32bb28
-
SHA256
3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f
-
SHA512
aed13d5f3a87bcbf99b760ec8bb73b6cebeb74b6f9ec188644cb998d7a5357732388d6097dbf0849180004f26ca414b420956d63cba978742553b8da2ac57cc5
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-