General
-
Target
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51
-
Size
52KB
-
Sample
220211-htaddsdgdp
-
MD5
9681d4f6e0aef7cd9cc840ab8fa52bfb
-
SHA1
8800114de9b4718c8d6e9efa231487991a916ddb
-
SHA256
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51
-
SHA512
3f0bad219d44f5cee70e5fab170198071b0f903866cd8ee35479fd6d13e6d6ec21212d9bfca1918dfa368a3961c672a0f85dcbba55a965e061a6144eb8c1e1a7
Score
10/10
Malware Config
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������04 52 64 A0 33 F6 E6 63 B6 7F CF 10 90 98 ED 1F
A2 34 90 68 80 6B D8 5A F6 5B 95 40 B2 D7 8E E0
FC 63 1B FC BB 9A FB 52 16 83 BA 28 29 BE 0C 8B
31 88 2E BC 35 86 84 30 36 C3 A7 2D 08 E7 7B 7A
57 25 FC C5 9D F2 5E 79 93 03 11 20 50 82 04 0F
FA 98 6A 43 92 B9 4D CC 0E 55 59 C2 B9 D1 4A 5A
C4 00 0B A0 F1 0F 0D 51 94 C7 B5 B7 67 BC 0D B7
B0 A2 CE 08 8E 83 BA FD CB 7A C7 EA CF 80 EF C1
FA 09 A3 DF 17 0B A7 A8 1F FC CC 09 A7 91 5A 69
3A 82 AC 63 03 D3 7F F3 F4 E1 7B 3F 1F 20 FB 34
AA 3A 45 AF D0 64 6E 29 B0 DB CF 5D D2 81 79 CC
78 66 DF 20 29 1A E0 81 12 89 4B C4 F7 30 FB 0B
5F 18 AA 34 48 0E 80 49 8A 81 0E E9 0A 63 DE BF
6D CE 92 3E 46 A9 2B FD 9F 10 29 E2 BE 69 A5 E8
49 9C E1 F0 E8 CD 89 CC FB A9 0C 0C DF E9 4D 54
07 77 17 C4 8A 13 96 49 38 81 19 C9 C4 F9 8F D9
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>��������
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">����������7A CD A1 E2 00 25 0E 50 1E 2D 42 3D 4C BC C8 A7
3C F7 99 97 8F D5 8F 0F 3C 5B 13 1F FC 72 05 93
7D 0E D1 16 AD 6E 40 AB 3B 56 DC DC 56 79 99 59
3D 6F E7 6F FE 93 62 31 7C 3B A7 EB F2 FD 42 CB
67 21 2E 5B 68 F7 21 25 A7 A9 3B 1C E8 62 B2 6B
89 06 6C 39 1B 7E 2F B3 C9 C2 24 EB 01 6F 2D 3B
83 7C 21 0D E9 7A E8 75 5B A5 6C 41 15 FF A8 AD
2B 1A 26 4D 35 DB B2 53 49 42 8A 5F BA 24 F9 EF
8E 42 5E 05 72 81 2C F4 D1 01 78 ED 20 3F B6 21
A1 6C 66 A3 C9 48 E5 AB 60 6E CB 93 AF B6 49 4F
7A F9 82 BF 8C AC 76 4D 82 DB 1F 88 D9 BB AC 84
9B 4C 46 99 78 17 F8 18 26 C4 19 CF 0F B7 91 79
ED 73 F5 91 89 30 DF 1D A1 C1 CA 3F 42 A9 4F 64
51 CA 6F 0E 79 0C A7 5C 41 B9 10 31 71 5E DA 8D
A1 94 CD E2 98 75 3A E1 80 9B 53 F2 68 4E 52 8F
B7 BF EB 95 51 B0 FB 69 32 C2 9A 07 D3 EC 3B 40
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br>
YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMENANTLY DESTROY YOUR FILE.<br>
DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br>
NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br>
SOLUTION TO YOUR PROBLEM.<br><br>
WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br>
ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br>
IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br>
AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br>
NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br>
YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br>
DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br>
BACK.<br><br>
<!--text data -->
<hr>
<b>CONTACT US FOR PRICE (BITCOIN) AND GET DECRYPTION SOFTWARE.</b><br><br>
<a href="mailto:[email protected]">[email protected]</a><br>
<a href="mailto:[email protected]">[email protected]</a> <hr>
</div>
<div class="text">
MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY
STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE
WILL BE HIGHER.
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>��������
Emails
href="mailto:[email protected]">[email protected]</a><br>
href="mailto:[email protected]">[email protected]</a>
Targets
-
-
Target
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51
-
Size
52KB
-
MD5
9681d4f6e0aef7cd9cc840ab8fa52bfb
-
SHA1
8800114de9b4718c8d6e9efa231487991a916ddb
-
SHA256
41bc93b935b78f929edfaeeb0a94177244e5af8488de81c963ef0f7a182bad51
-
SHA512
3f0bad219d44f5cee70e5fab170198071b0f903866cd8ee35479fd6d13e6d6ec21212d9bfca1918dfa368a3961c672a0f85dcbba55a965e061a6144eb8c1e1a7
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-