General
-
Target
302422d0180ff35cd414c163df958506d188fcf9c8abfa688b61101dc36c02b8
-
Size
53KB
-
Sample
220306-fbsqxabgbq
-
MD5
64dccf9ee4907071496ba67d8f18556a
-
SHA1
e7c703088ee567a88d5fbcaac1b281ad6fbe020d
-
SHA256
302422d0180ff35cd414c163df958506d188fcf9c8abfa688b61101dc36c02b8
-
SHA512
dc9d34349eaac7897a149cadf70b92c78a0f2bfacaf995495be901bc66ca2200d0c3d0c14313092ff13e8fb67680ace129b317c5824ae9cb0d4fc1a9aa95ef3d
Score
10/10
Malware Config
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������16 6E 2B A3 C3 3C 7D 87 66 17 44 E5 75 EC 08 AD
7A D2 FF CE 42 1B CE 8C 55 A8 22 06 B3 42 0B 31
DA 2E 5E 01 9D C8 43 94 CD CC 63 B3 C4 1D 5A 84
62 34 49 02 44 3C 39 56 9C 66 36 D0 6D 94 F7 85
DD 6B 9E D7 20 34 6F AE D9 B8 DC EA FC 02 69 41
55 E9 3B BB E9 55 34 95 AB 2C 6F 30 10 7C ED 96
9F 55 B8 D9 4D 85 58 E8 4A DE 9B 1A E3 24 31 23
3C 7E F8 BE 5C 34 B8 58 73 8B 27 D2 FD 1A 15 9E
8C 52 A4 FC 4A 94 33 05 C6 2F 5C 01 64 A6 5C 54
E4 33 11 17 07 A8 4F C1 32 7A 09 3F 79 78 0B 9A
1C 99 41 4D 1A 52 9C 85 BF 1E 91 5A 87 7A 47 17
5C 58 9F B7 65 99 87 6C 38 F2 2A 9E E1 EB F1 E9
4B A2 5D F7 F8 2B 04 F7 2B AE 7A 36 4C FA A8 A3
2A 22 98 3A 47 C9 CD BA 0C D5 3E 09 C8 6D CB FE
AC 7D CA 82 60 BD 4A 5C 3F C0 8B 0D EA B2 09 06
AF 2C 03 A3 CD 49 47 CA 99 8D 98 FB 2E ED F5 F1
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span> [email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li> [email protected]</li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>���������������3B 6C 87 7F 2C 24 FB 5C 0D 3C 44 98 D2 A9 F1 68
8A 7A 6D 1E 3A C8 CB 05 8B 2B AF F4 44 26 B5 28
0F 89 17 C4 0C 23 26 78 DD 63 B5 3F 5C 9E 2F 22
C5 0C 0F D6 69 F3 CB AD A6 D5 9B 68 9A 47 B9 A0
FD 5A 90 B6 25 D4 1F 52 AB E4 F9 8C 90 E3 9B 06
ED 8E B5 61 74 7F 0F D0 6D 22 EC 0A 5B 9F 72 ED
A3 1E F9 42 77 02 C8 AC 46 4A 52 F9 FF D9 72 A0
1F A9 83 30 86 C7 5D 47 86 D3 DC 9F 88 99 80 85
02 8A 0F 9A BA 08 11 62 63 57 B4 EB DC 89 C5 01
80 87 84 0B 44 18 F8 B8 1B 93 90 26 4C B3 0D F6
3C 7E 00 B5 33 D8 A7 1E FC B9 9F 68 62 86 0D E7
FD 2E 3D 8E 8D B0 69 DD D0 7F F2 B1 EF 68 E1 0C
F1 AF 79 3D 7C 1B 5A F4 86 F3 20 A1 40 D4 73 CB
A2 6C 66 55 0A 0D 59 A9 18 C9 42 A6 DB CB 9D BF
1A AA 7D 11 96 6A EE D1 21 6F 46 DA 7F AC B2 91
7D EE D7 1F CF 5F FE E0 63 91 64 AA 77 9A 3B 75
</pre><!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span> [email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li> [email protected]</li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Targets
-
-
Target
302422d0180ff35cd414c163df958506d188fcf9c8abfa688b61101dc36c02b8
-
Size
53KB
-
MD5
64dccf9ee4907071496ba67d8f18556a
-
SHA1
e7c703088ee567a88d5fbcaac1b281ad6fbe020d
-
SHA256
302422d0180ff35cd414c163df958506d188fcf9c8abfa688b61101dc36c02b8
-
SHA512
dc9d34349eaac7897a149cadf70b92c78a0f2bfacaf995495be901bc66ca2200d0c3d0c14313092ff13e8fb67680ace129b317c5824ae9cb0d4fc1a9aa95ef3d
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-