Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    star.exe

  • Size

    360KB

  • Sample

    220626-gsbdmabdf2

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���02 67 2E 9B C9 FE 3A 87 64 AA 6D 2A 6B 12 6A 5E F3 E5 3C FC E4 BB F4 EE 5A F0 C5 FA F4 D3 54 35 86 73 F0 BD C4 1C 04 E0 6C 7D C3 49 32 D6 2E FE 97 51 EA 89 E5 37 F3 B1 3C 91 E3 A1 12 89 39 F3 8E B7 FF 2D 96 94 36 96 A0 06 7B 65 99 07 A6 18 36 E1 14 CF 99 DD 9D 9D 3C 15 2D A0 39 8E EE E8 C0 E1 2F 25 7E 7E BA 7A E4 FA 06 0B 08 59 8D F0 BA D2 43 BE E2 1C A5 FA 51 53 B6 8F 74 FB 3C B4 E1 CF 0C 6F FC 57 28 A8 00 42 C6 E4 81 52 FA 89 52 30 1D 1E 06 43 E1 C5 77 C6 FE FA D9 70 A6 99 44 05 E6 C0 48 18 BB AD B2 1F B7 8F 43 33 8A 86 7E 30 7D 1C 2A D5 19 BB E9 64 6C EF 9C 21 65 27 AA 12 5E 87 69 63 63 60 6B 35 90 DE 5B 22 21 7B 63 7B B8 38 4F 2B 69 3D 4A 77 DB 5E D9 C1 90 C2 D4 00 00 CD 4D 64 4B 80 AA 86 15 42 EA 9A CC AB 11 CC CD 87 9B 63 66 FE 50 21 A3 CF 9F 71 65 95
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���B6 3E 2F 06 3B E1 5B 41 54 30 24 F3 0A C2 7F 3A EB 18 04 1E 50 D6 4F 81 46 E4 AA A5 39 B7 2D 5B 94 55 5E E5 26 8D 0D E2 63 B5 82 51 04 22 0B DC E8 DC 5B 7E 64 AB 77 8F CB 7C B8 71 AC 4A 48 0E 76 D2 BB 0C F8 97 0D EB 09 AA 73 07 59 3D A6 E1 9E 1D 37 A4 DA FC EF 46 B4 63 EA 89 3A 97 66 B6 6A 8E E6 EC FD 78 25 48 E9 0F 0A 30 75 15 AA 02 B8 91 51 90 30 F7 7C A6 E0 9F 7A 44 0F 57 DD 64 B6 F7 C8 99 C1 82 87 24 4E 98 B1 62 58 16 3A 38 1C 24 D8 10 1E B9 C8 E9 C1 2A F2 83 2B 4D 14 47 28 F9 CA 54 DB 0A 77 FA AD 52 7E B1 FA 5C C7 CE A6 8E A4 0A B1 5A A8 F5 A3 66 E0 EF 96 B0 6B 0B 49 A5 15 8A A2 AE 96 4A C8 A9 CB 73 7B A0 E5 B6 9C FD B7 5E 5D D8 C3 CD F6 AA 79 33 4C 9E 27 4B 92 96 E6 E3 63 26 87 EB 93 EE CB 9C 67 59 A0 D6 D2 9E 8B EE 9D 4F 40 0A 76 34 BA B1 59 8E B7 07
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Targets

    • Target

      star.exe

    • Size

      360KB

    • MD5

      2f121145ea11b36f9ade0cb8f319e40a

    • SHA1

      d68049989ce98f71f6a562e439f6b6f0a165f003

    • SHA256

      59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

    • SHA512

      9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks