Overview

overview

10

Static

static

08f7c2a8b1...17.exe

windows7_x64

10

08f7c2a8b1...17.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08f7c2a8b124972c88f685d28e19b7a4dfdf63a4d2aabf3bb2672900d11fd517

  • Size

    270KB

  • Sample

    220530-y13lhsdfhm

  • MD5

    b44f00cb1edb37de99b3433e1923690f

  • SHA1

    214e0da093d49cfc4ff6c34515767dc079daaeed

  • SHA256

    08f7c2a8b124972c88f685d28e19b7a4dfdf63a4d2aabf3bb2672900d11fd517

  • SHA512

    529c279d2cf5ab854adf02d47924fa351a21c58a912323b164da4c3840a52376ef74a4b021fcf610794b3b1d99b3775365d21041404038bc3ca1101e6b0641c8

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������7C 71 F0 A6 D9 56 79 97 51 03 1E 1A 84 4A BC 23 25 09 60 F8 11 E8 CC 78 19 ED 25 09 6F A0 2F 78 5B BF 17 D4 AB 88 B5 23 6B C3 31 9F 48 F5 9C A6 98 F8 79 FA F6 9D D6 D5 12 CD 63 39 D0 45 0E 9B 94 40 F5 03 DE AC 56 A6 2B 90 01 03 E3 48 D7 87 6F 27 99 A8 35 9E B2 6D 87 3C 0C 22 51 3C 68 31 C6 D9 80 D7 A9 A1 2A FA CA C6 6F FF 16 6A 51 A4 F5 BE 24 83 C0 FA 14 6A 57 B2 4C E6 AC 7B 92 4C 3A 52 5A 94 C7 71 D7 24 43 4A 6C 48 5E 30 32 5A 7D F0 0E 46 D5 2C F5 06 27 58 79 18 0E 98 88 A1 9F E1 14 50 17 BC B6 85 AA FE 4B 63 D8 A1 D0 84 55 1F 63 B0 B2 A2 6E A5 00 B9 B0 F5 5F B0 CB AA A9 BE D2 B2 3E 00 C3 89 00 C5 0F FC 61 C4 E1 A5 0A 9C 29 88 2A C4 BE 4F 21 B3 FB BB E1 CC D3 DB F3 FD BE EE AA 53 C9 06 10 EF 78 7A A2 4D 26 49 43 2C 4F 72 75 9F 63 2C 44 BD 79 05 17 70 C7 99 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������7E 81 92 3B CD 9E D6 3B 78 A0 DD E8 29 84 5B 7B A6 FF 0C B6 54 94 B6 62 E2 61 81 E0 46 A9 19 E5 79 55 3F 23 FA 7D 19 39 EB 8C 66 96 C7 93 44 9D 61 B3 54 26 E9 44 10 6D 60 FD 19 5E DB 63 CD F9 69 1E D5 CE 9F 35 E6 E3 92 C6 9E 6A 10 06 CB 6C 2A B6 8D 7D 8A 81 5D 73 36 1A 02 D7 65 16 49 C5 9B 5F 0F 0C 57 D7 FB CA 40 3C A6 F8 86 14 4C 14 BD B7 BD D0 95 2B 01 1F 31 2B 62 DF 81 18 2D A1 8E FF EA BB E5 BE 97 D8 CC 6C D7 B8 47 1D 25 8F B0 1C 48 56 77 28 D2 E9 A5 45 A9 A6 CC 67 2E 3C E1 5B 2C E8 A6 0D 0B E9 5D E0 24 A0 6C 6A D6 F1 A3 C8 BD 6E 9E EF D8 5B F5 FE E2 BD 92 06 67 7A 81 AE EE 30 DB 51 45 E6 C3 CD A8 57 5A 0B 51 B6 5F 7D F6 7C AD C8 64 1E 9D 9A 6A 9E 61 8A CC A7 6A F2 64 5F A6 EC 01 A1 56 E0 C1 9C 90 A9 A4 25 CB EA 66 82 17 D7 EE 26 C5 AA B8 9B 9D D3 B4 0D ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Targets

    • Target

      08f7c2a8b124972c88f685d28e19b7a4dfdf63a4d2aabf3bb2672900d11fd517

    • Size

      270KB

    • MD5

      b44f00cb1edb37de99b3433e1923690f

    • SHA1

      214e0da093d49cfc4ff6c34515767dc079daaeed

    • SHA256

      08f7c2a8b124972c88f685d28e19b7a4dfdf63a4d2aabf3bb2672900d11fd517

    • SHA512

      529c279d2cf5ab854adf02d47924fa351a21c58a912323b164da4c3840a52376ef74a4b021fcf610794b3b1d99b3775365d21041404038bc3ca1101e6b0641c8

    Score
    10/10
    globeimposterlockbitpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks