globeimposter | 2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274 | Triage

Sharing

General

Target

2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274
Size

220KB
Sample

220614-3hybasaccq
MD5

7b65b6bdd6866345d6f9d0e18a0dcbc9
SHA1

fe3fdda918a3db1b17fc48716b574356700d5fc0
SHA256

2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274
SHA512

0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274
- Size
  
  220KB
- MD5
  
  7b65b6bdd6866345d6f9d0e18a0dcbc9
- SHA1
  
  fe3fdda918a3db1b17fc48716b574356700d5fc0
- SHA256
  
  2c34888b579bfe9598f5ab006346ce318ece71375b4deed4a5baf46aa867f274
- SHA512
  
  0e73217400e0763ff6e455f7e6fec40b9bfc849c45d2dfec88e5b4ea7f5f102578a0694d35c1b18993bf8f41a5bcbf09903f5bc9662b08fbcae4f6484a274ef1
Score

10^/10

globeimposter persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

globeimposterpersistenceransomwarespywarestealer

behavioral2

globeimposterpersistenceransomwarespywarestealer