General

  • Target

    33611fbde2eca82c40b9805042b7eb52eecac7175989a9c583ffa99e35013b82

  • Size

    54KB

  • Sample

    220211-hvveysdgfm

  • MD5

    8d891e2a909179d902d9bd4eca8fee27

  • SHA1

    966ddf72757d1b8c85986985477e76dcf5afc8aa

  • SHA256

    33611fbde2eca82c40b9805042b7eb52eecac7175989a9c583ffa99e35013b82

  • SHA512

    f4ad92aefd004ba2761870108c9873d9d99b386636cf08578506bc0a1134ab6ec10c6acd4b08de6789822912778125a469a7df376c1bfed39f5d592bf074fdf4

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��48 63 F5 53 71 ED 81 64 F5 55 77 D7 7A 98 BF 4A 0F 60 9C 1B 4A 77 A5 E9 B5 E0 2F DE B8 BF 3A CC 99 D2 94 D2 9E AD 86 FF 31 D5 D2 AD 72 C1 10 95 26 14 29 0F 31 44 B2 27 C8 43 1F 12 AE 5F 7F EE 22 B2 1A EC 5E 36 BD 92 83 83 AC 8B 03 74 5E B8 1D A3 A5 F8 D5 73 DE BD 2A 56 BC 55 E8 D2 74 EC 6F 82 9E D7 2B 1A C6 EF 20 95 4C F0 AF AF B5 1A 8F 08 94 F8 F9 F0 A2 42 EA A1 C3 C9 A9 19 E0 D8 8D 91 BE 68 B6 74 8A 3F 03 46 2A C2 EE 17 44 DF 85 11 B4 33 A8 3E 8A 49 65 76 11 D9 DD F6 5E 5B 21 EE 0B 1F 2B 67 3E A1 70 71 AD 98 8C BD 66 EF 64 14 47 29 27 F0 27 CD D7 80 68 E9 B5 63 80 71 8A 02 C5 6F 89 2A 3D 8B 05 58 30 1B 6A 5D 05 9D DF 55 D1 87 83 09 F2 B0 A9 1C E0 9A BE E7 1C F6 DE BE 30 35 D5 CF 2C A2 60 DA 5E FC 4C 62 23 C0 B6 26 0E 1D 85 48 1C 4A E2 5F 4B 9A B4 47 06 C2 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ��

Extracted

Path

C:\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��1F 97 D4 2E D3 39 88 C0 87 04 80 FE 08 44 4D AC 83 54 C2 25 24 03 DA EE 21 CB A1 69 42 AC 77 E4 22 9B 37 58 56 36 7E 08 8B 35 77 2A AF 28 C6 F4 01 D8 7B 69 07 C3 47 43 3B D5 8E BE 6F 6B A7 A1 BD 5D 87 69 77 B3 29 10 02 5C 78 2A 9D B1 CA 3D BC BB 4F 7C E2 8F 47 50 DD ED 2A 58 5B 84 18 A2 EE 00 46 15 80 74 49 03 DB AF ED 2C 8D 2A 3B 56 5C 5C EF E8 D7 DA 3C DE BB 52 C5 0A 1F F8 31 05 2C 97 6D 48 65 EA 65 EE 64 81 2C 01 B6 16 67 F2 F5 82 7E 50 C2 BF A5 B9 49 AA 24 B1 B7 18 70 7F 9A FD CD 44 79 82 0E 2E 3B BC E3 D7 BA 50 84 82 9A 0D 48 6C A2 C6 81 4B F5 0D 9E 19 6F 69 86 31 B2 A4 7D 9C A8 52 5C 14 CE 94 F1 E3 E3 8D 35 A7 CD 79 1F B8 36 AE C4 BA DE FF 34 BF 84 0E 2B 54 D4 61 56 CA AD 5D 27 2B 73 00 39 AE A9 5E BC 7C 5E E9 91 59 E6 DD E6 D1 73 74 43 91 C2 A0 E5 29 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ��

Targets

    • Target

      33611fbde2eca82c40b9805042b7eb52eecac7175989a9c583ffa99e35013b82

    • Size

      54KB

    • MD5

      8d891e2a909179d902d9bd4eca8fee27

    • SHA1

      966ddf72757d1b8c85986985477e76dcf5afc8aa

    • SHA256

      33611fbde2eca82c40b9805042b7eb52eecac7175989a9c583ffa99e35013b82

    • SHA512

      f4ad92aefd004ba2761870108c9873d9d99b386636cf08578506bc0a1134ab6ec10c6acd4b08de6789822912778125a469a7df376c1bfed39f5d592bf074fdf4

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks