Overview

overview

10

Static

static

359dba8d27...6a.exe

windows7_x64

10

359dba8d27...6a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

  • Size

    471KB

  • Sample

    220626-3mf8ksehgk

  • MD5

    68ae1cfdc0b53730b7ad43781155e598

  • SHA1

    fb4b60e97cb4445957d74de46b842e7d51ae950c

  • SHA256

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

  • SHA512

    0dbf148442cee19da08d6a5033013098e75f31c79057d2b2a76e43bfbde6e60aba495d12aeb69be31eb60c8e20e48256e93f62e0e4453c573d240fb37db710f7

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������4C 43 00 DF 3F 98 BB 08 3F 1D 3B AF 4D 50 54 FB 5B 69 65 B3 DF E4 1A E8 6F E8 BE 79 61 5F 22 7A D1 E3 40 98 71 EC 5A B2 BD 0E 5C 70 25 EE F1 1C 2B FD 36 12 07 4F 3C DA 22 2C 3B ED 95 39 A5 C1 F3 C5 CE E9 60 84 5E 7C E3 B2 7E 84 70 8F AE 77 28 DE 0A 13 E7 5C B7 37 BF EE E6 95 99 A3 E7 37 2F B7 51 02 16 8F 9F 4D 85 85 D4 DC EB 0B 51 2C FF 9B 6A B3 EA 7F 7E E1 50 0E A8 0A 2D 5F DF 0D 95 03 36 F8 6D DB 58 8C 75 AB B9 60 55 3B A1 8B F6 53 C3 73 1D 44 C1 AD A5 7C AF ED 01 CB 21 8A E2 D5 C7 0E BE D8 FA C9 BB 46 6F 36 DD 66 F0 ED 75 AE 8A A8 30 27 B3 DA F2 64 C9 7A 22 17 69 68 6C 78 8F B9 9D 37 AF 5A E1 B2 68 AD C7 05 BF D5 3B 67 4B E1 56 51 11 90 86 88 E0 23 59 33 21 57 92 60 C6 D5 20 0E 93 79 E8 4A 77 28 E7 7A 41 CC AF 81 E9 53 C2 80 FA 50 3F 72 C5 AC F4 A6 5F 73 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������56 42 28 D6 05 CA 91 48 8F 81 1C 5C 3A 61 8D 04 4F B4 02 57 AA 2E 5B C0 69 15 A7 29 8A 38 B0 F7 60 4B 3A 75 FE 4E BB 39 AD C8 F6 33 F6 27 B3 37 CD 63 56 DA 00 CE 4E 3F D6 77 FD 2B EA 87 A3 F0 4C CF 4A A9 8C 3F 24 CC 94 35 02 D7 36 BA 4A A1 16 F8 B9 D7 27 AF 25 7C D6 77 AC C9 AD A8 4B D9 13 92 24 3C 28 7C BF 9E 3B 9C 2D 0C 79 BB 7C 58 AD 62 DA 93 F2 E0 2F 8C 58 6D 29 8F DF 46 A7 1A CA 3C 7D D8 3F B0 43 4C 2F 37 A3 BE 49 E5 80 E1 B6 07 0B 32 81 23 8C C1 11 0F F2 73 83 25 8B 3D 6C A4 4C CF 82 A4 71 D8 5E F9 8B 57 B4 6C 0D 03 0D 43 1B 21 09 CA 6D 88 2D 6A F2 81 07 7A B7 CE 93 D3 91 9F 37 04 29 CB AC 92 EC BE 06 E1 39 2E AE 10 64 58 2C 3D 72 73 AA 0C B3 B7 17 B0 81 24 53 B2 D9 AC BB 44 4E 28 27 9C A4 A0 BF 46 AD FA 3A 78 EE C9 09 FD 68 28 F7 C8 42 5F 16 4F 39 51 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Targets

    • Target

      359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

    • Size

      471KB

    • MD5

      68ae1cfdc0b53730b7ad43781155e598

    • SHA1

      fb4b60e97cb4445957d74de46b842e7d51ae950c

    • SHA256

      359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

    • SHA512

      0dbf148442cee19da08d6a5033013098e75f31c79057d2b2a76e43bfbde6e60aba495d12aeb69be31eb60c8e20e48256e93f62e0e4453c573d240fb37db710f7

    Score
    10/10
    globeimposterlockbitpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks