Overview

overview

10

Static

static

2864449649...7e.exe

windows7_x64

10

2864449649...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28644496493462629e22aeebb030e2536dbdaccdaee4dd782106f3b5099e897e

  • Size

    106KB

  • Sample

    220615-wa1m5achc6

  • MD5

    0734b966a27e64eaeff718b18e469f6e

  • SHA1

    8214a6f9ac0c5c4ad4830b6829f2811a2dcfefe0

  • SHA256

    28644496493462629e22aeebb030e2536dbdaccdaee4dd782106f3b5099e897e

  • SHA512

    8a8c46890516e3e34be1de04a24720af96c217c472e133568b7220a191bab5560a9008aeb3d2c9239634295896ef237502c92cbe1fcfc51c76ce0adfbe73e063

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://alcx6zctcmhmn3kx.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 2 file for free decryption. ------------------------------------------------------------ alternate address - http://dtutgqjuzv7sktgl.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������42 46 D2 42 DC 63 44 82 EA 28 DB 1A F5 3D 17 58 24 5C 0A A5 F9 93 98 F1 BF 90 A6 E4 2C 02 F6 DB 4E FA C4 D9 78 0C A7 51 F5 5E 2E A0 AC 4F 43 B4 EA DA 1B 61 51 5D 30 CE 18 8E 2C 4A 05 9A 06 E4 BE F0 03 A5 53 FF B8 77 B9 08 C3 B9 94 CB BF 05 85 9A 98 0A AE 1F FC 82 C3 94 A1 9C 41 E2 78 A8 66 D9 ED 0E D8 AB 6E 69 C8 56 EA 9B 6F 32 68 4C 24 F0 16 10 96 5E 92 05 DD 73 95 BB 46 28 35 61 71 4E 57 2B EA E5 FB 68 C7 56 40 54 80 3E 69 A7 B8 B8 4C 28 69 2B 77 B8 F1 33 58 B4 EB 4B E5 8D 9E 72 32 9E 8F 1F 5E 05 D6 9E 0C A5 90 3D DA 78 F2 58 D8 A7 10 22 6D D1 45 5F 25 91 82 22 EC D2 E2 C3 DC 0C 04 DB B7 04 16 9C 48 7D 60 2E 05 29 BE E5 67 3D BC 0F 5D 49 16 86 BC E4 DF 89 9D E9 93 86 29 3C AF 86 D7 31 14 B2 06 26 35 51 8D E9 2B 7A BD 8E 91 E2 A9 D0 38 38 D2 BA E7 0C 87 EE ###�������������
URLs

http://alcx6zctcmhmn3kx.onion/

http://dtutgqjuzv7sktgl.onion/

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://alcx6zctcmhmn3kx.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 2 file for free decryption. ------------------------------------------------------------ alternate address - http://dtutgqjuzv7sktgl.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������78 43 92 27 FF C1 2F E4 81 AB 69 E2 2D E5 7E AD 99 4F 6E 3B 6F B4 05 65 43 EE 86 3F 2B 9F CB 54 79 9D 95 B8 0D 88 EB B1 DC 68 31 35 8C 25 88 A9 0B 50 A9 5B A3 9B F2 F8 A9 1D 8E 87 0C A3 78 5D 7B F2 54 2B C5 AC B4 15 6B CB FA F8 8D DE EB AB 14 0C 1B 6C 06 1B FC 9B EC 7F E3 F7 A4 80 EF AC 0A A8 61 67 FF C3 52 83 CD D7 C8 58 29 03 62 79 53 CF E6 12 57 28 04 B2 10 AF A7 44 E9 8C 8E F6 47 81 59 79 8C A7 DD A1 B9 79 A9 17 FD CB 93 01 77 D6 51 CB 29 72 06 ED 99 27 EF 1E 45 DA 76 62 39 29 66 C4 93 E1 1D 0F D0 96 1D 6A 8C D3 34 87 37 F5 68 62 82 A1 78 78 8C F1 B4 17 F4 3F 85 8E ED 6F F8 96 86 72 28 A2 D1 CE C5 DC 18 FA C6 25 48 4A 79 9A 9D FE C8 FE 26 92 BD D6 96 46 88 F5 60 2F E8 8E 66 61 33 8B 44 96 0A C2 44 72 1B 23 88 6F 3E 17 E6 86 BD 93 D4 9A 8F AA 2D E5 DF 44 ###�������������
URLs

http://alcx6zctcmhmn3kx.onion/

http://dtutgqjuzv7sktgl.onion/

Targets

    • Target

      28644496493462629e22aeebb030e2536dbdaccdaee4dd782106f3b5099e897e

    • Size

      106KB

    • MD5

      0734b966a27e64eaeff718b18e469f6e

    • SHA1

      8214a6f9ac0c5c4ad4830b6829f2811a2dcfefe0

    • SHA256

      28644496493462629e22aeebb030e2536dbdaccdaee4dd782106f3b5099e897e

    • SHA512

      8a8c46890516e3e34be1de04a24720af96c217c472e133568b7220a191bab5560a9008aeb3d2c9239634295896ef237502c92cbe1fcfc51c76ce0adfbe73e063

    Score
    10/10
    globeimposterlockbitpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks