Overview

overview

10

Static

static

2b867c6e10...d7.exe

windows7_x64

10

2b867c6e10...d7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7

  • Size

    230KB

  • Sample

    220615-cbbkvafdgk

  • MD5

    7f7eb2a3463e393d6c36710f5d6eebfa

  • SHA1

    a38b3be749b494ed0a73f00dca89069f97b53c0f

  • SHA256

    2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7

  • SHA512

    48ee1d9b1abf5836a2e88fd7e550531057912c1ee1b55aacc54c0d86884085cfcd8aff1c232cd7d1351d6b92e79b6a405214a94c53bceadbc78172a5954a51ab

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7

    • Size

      230KB

    • MD5

      7f7eb2a3463e393d6c36710f5d6eebfa

    • SHA1

      a38b3be749b494ed0a73f00dca89069f97b53c0f

    • SHA256

      2b867c6e10783c3f3560d315c8850e06008eff65a9319e5f21dd35104e41f0d7

    • SHA512

      48ee1d9b1abf5836a2e88fd7e550531057912c1ee1b55aacc54c0d86884085cfcd8aff1c232cd7d1351d6b92e79b6a405214a94c53bceadbc78172a5954a51ab

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks