Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    star.exe

  • Size

    360KB

  • Sample

    220601-tttmtadhcp

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���11 5D 33 7B F0 90 28 54 08 D5 EA A6 22 94 30 4B 7F 61 F4 EB 62 76 34 9B 01 00 81 F8 D3 1D 9D 7A 00 40 9D 70 51 42 F4 3B 6B 4F 9D 0F AF A9 07 BC FA 6F 5C 90 5F CD 35 23 9D 91 EE 22 5E 91 FE 5D FC 7B EE 6C B3 44 5F CC 97 B9 BA 89 6A 6E 73 3E A2 1F A7 6F B3 9B 90 D2 82 FB E4 20 76 58 95 93 89 ED FA A3 F7 73 DE 7B 9F E3 CD 94 57 71 04 88 28 24 CF 70 7E D5 D4 D8 9E 17 EF D5 73 7F A2 26 3D 70 6B 7C 2B F9 17 98 68 CF 51 85 5E 6B A2 89 60 95 5A EE 88 35 61 DF 13 95 4C 94 34 B5 C1 13 4E 98 44 1D 6B 92 C1 B9 8F 1E F4 79 A5 E4 65 7F A5 E2 E7 CC AA 2D 8C F4 75 8A 3F 92 2C 1E 0F C2 42 59 28 55 98 D0 80 D4 99 77 79 76 9A 33 85 B4 C0 D2 3B 1F DE 63 FA 0F BF E3 79 56 97 78 18 30 C4 1E B7 F6 E8 03 3C C1 1D 51 E4 EF A2 C9 63 E0 FD DB C6 39 2F 7F 06 97 8A 11 E3 DC 18 6F F4 A1
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���33 9A B5 50 35 F2 5D C4 8C 9E 10 A9 C9 EE B8 9D 36 3B A7 55 72 3E 79 6C 5C DB 3A A5 BA A1 52 DC 09 2C 52 15 98 80 3C 99 87 46 78 D8 2B FB B9 45 EC BA E1 4D F0 DE 52 89 14 59 75 25 8F 2A A6 9D C2 7D E2 34 D4 93 90 93 AC B4 5B 4B CB 58 AA 55 82 7C F7 66 11 1C 2A 8C A0 84 31 9F AB C2 BB F5 D7 07 FF 01 47 0B ED B1 A4 3E 53 FD F2 B1 1B 28 81 C3 FA D1 9F 23 D5 04 1B 53 EC 70 1B 8C 7F C9 9E C9 3B FA 1F 9C 94 A0 C7 07 97 5A EA 14 C0 62 10 E9 0F 53 C8 AE D8 50 6D 39 A5 56 F5 CC 94 51 B3 30 04 0C 60 99 8E C8 BB D5 50 F1 F3 8A 74 55 C9 A2 5A 6D 30 40 F0 25 DC 84 24 F5 AA B6 DF 80 92 D0 FA E7 65 96 05 47 87 7E 3B 19 E3 A9 08 62 DA A9 8A 8F C5 87 5A 42 4B FB FE 95 B0 E7 8C 37 65 0F 46 AA D8 7F 32 E6 D5 9C CD DE 50 DA 3A 18 C1 D7 66 7F 19 10 6D E2 1E D5 06 91 FA E1 9B FA
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Targets

    • Target

      star.exe

    • Size

      360KB

    • MD5

      2f121145ea11b36f9ade0cb8f319e40a

    • SHA1

      d68049989ce98f71f6a562e439f6b6f0a165f003

    • SHA256

      59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

    • SHA512

      9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks