General
-
Target
3f76e1891af1dad5c01eda9273e624c48688062b76fd1a496e7dc087cbba46e3
-
Size
30KB
-
Sample
220701-bxc55aedcr
-
MD5
95a8c1a64f7a4046930f0ecfa8c4e9ea
-
SHA1
2565c376f354ac8dd34929df1c3959d76d260e6a
-
SHA256
3f76e1891af1dad5c01eda9273e624c48688062b76fd1a496e7dc087cbba46e3
-
SHA512
97413990ee538caedd322e7030f612eeaed1c7f8a9d97e2cb874f0f0c7d4305d4acd4a1d6d85b0c2c1368576e025457e364cd8c2bad7991b5f91085925980b73
Score
10/10
Malware Config
Extracted
Ransom Note
Your files are encrypted!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
To start the recovery process: Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked). Send a email from your new email address to: [email protected] with your personal ID.
In response, we will send you further instructions on decrypting your files.
Your personal ID: It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.
Check the folder "Spam" when waiting for an email from us.
If we do not respond to your message for more than 48 hours, write to the backup email : [email protected]
-----------
Q: Did not receive an answer?
A: Check the SPAM folder.
Q: My spam folder is empty, what should I do?
A: Register email box to protonmail.com or cock.li and do the steps above.
��������
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Don't worry, you can return all your files!<br>
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br>
The only method of recovering files is to purchase decrypt tool and unique key for you.<br>
This software will decrypt all your encrypted files.</center>
<br>
<center>----------------------------------------------------------</center>
To start the recovery process:
<ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
<li>Send a email from your new email address to: <strong>
[email protected]
</strong> with your personal ID.</li>
<li>In response, we will send you further instructions on decrypting your files.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������������3A ED 54 CC AD A2 0B 42 E3 64 E1 09 D5 F6 61 C5
C7 2B 85 CF 02 28 A0 B9 7E F4 D1 FA CA 18 06 54
3F 48 D3 C6 38 11 A6 08 10 3D D9 AD 2D 02 9D 43
3A AF C1 2F 79 8C E0 4B A2 BC 4B F9 D2 9C 81 3C
67 70 47 CD A4 DC DD F0 8E EA 4E 31 37 1F 33 8F
06 D4 10 F1 47 8E E9 74 DD 9A 9C 30 1C 92 67 28
12 5A 04 C7 FE 6B 28 41 12 C4 84 CA 68 DE 93 32
E3 7A 47 EA 96 F9 78 77 35 46 95 DC AF ED 95 78
EF 11 E2 81 BC AF E0 16 CD 6B F1 4B 88 F4 9D C3
7E D2 F3 6D 60 6E 41 86 B8 BA 0D F7 F9 86 56 EE
81 6A 28 1E 24 3B 7A D9 A4 16 3F E3 BE 0E AB 59
2A 2A 68 A2 E0 BE F5 DC CA E3 F5 A9 B9 95 A7 8D
B0 02 B1 FB 8E B6 2E 2C A9 BE E3 A8 93 C1 FA EA
C3 1A 39 1F 39 91 A1 97 59 74 7B C3 EF 2D 79 3B
D3 46 19 46 72 69 74 64 6D EB 21 29 37 2E D5 E8
2C E6 75 9F B8 0E 1E 36 3F 26 F0 00 E9 10 7F 17
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>Check the folder "Spam" when waiting for an email from us.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
<li>-----------</li>
<li>Q: Did not receive an answer?</li>
<li>A: Check the SPAM folder.</li>
<li>Q: My spam folder is empty, what should I do?</li>
<li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>��������
Extracted
Path
C:\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Don't worry, you can return all your files!<br>
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br>
The only method of recovering files is to purchase decrypt tool and unique key for you.<br>
This software will decrypt all your encrypted files.</center>
<br>
<center>----------------------------------------------------------</center>
To start the recovery process:
<ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked).
<li>Send a email from your new email address to: <strong>
[email protected]
</strong> with your personal ID.</li>
<li>In response, we will send you further instructions on decrypting your files.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������������81 53 61 1B 1E B6 51 A1 E8 C1 73 43 E3 91 91 F6
59 6C 74 10 04 13 FB 64 DF 8B 39 2E BC FC 4A 4D
20 09 67 17 DF 7B C7 16 11 B9 FD C5 69 5F 1A BF
41 E2 C9 CC 62 CA 22 6D AF 41 63 1C 63 2B 90 48
C1 B5 4E D6 00 B3 1F CA 18 27 BC D8 4F 17 F2 D3
FA E3 EF 9D BF E7 38 E9 B2 F6 F3 60 1E 38 67 AB
C6 CE 86 4B DA B3 EB 85 25 02 4A 58 19 35 66 4D
42 DF 6F CA 3E 25 45 E1 3F E1 87 1C 30 B3 0E 5D
F2 C3 05 36 41 12 09 F5 CE 34 99 6E 46 51 8E 2F
5E FD A6 A5 1E 56 56 D6 39 10 FD 04 45 BA CA 66
35 4D 38 AF DF 36 06 61 08 DC D2 EB A4 37 D6 7E
3B 8A B0 07 66 29 0E E1 E8 83 28 9C 1F 7B 8E F3
11 CB DA 68 56 89 E7 B4 9D 9C 64 05 0F 2B 2C C4
52 11 46 0A 14 3A A2 45 BB C6 96 60 EB F1 1F 9A
9B 0E 2A 1F FE EC 4E A5 B8 9E D8 8F 3F 88 4C 17
5A 8C BC C0 58 CF A4 97 DA E3 B6 C0 5D 7B 0A 4F
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>Check the folder "Spam" when waiting for an email from us.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li>
<li>-----------</li>
<li>Q: Did not receive an answer?</li>
<li>A: Check the SPAM folder.</li>
<li>Q: My spam folder is empty, what should I do?</li>
<li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>��������
Targets
-
-
Target
_ing_.exe
-
Size
53KB
-
MD5
b9a84d52093a20975d44418e9eaec631
-
SHA1
fa464b36590d93a4ec6d9f63817dd931dd1a9ac8
-
SHA256
e0e0c26b78f258324345886b83c8a0b6bf6b8ccdf5412c5dfdc10141932090ab
-
SHA512
ad7d95c59b17586f1214ad9f1696de153d0cd6e2b375efa3f93057b6ed07aba1048f71238dfb59b29b1a47fdd7eca4d846cdb00fce901d5526d2c33c1448b96d
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
-
-
Target
how_to_back_files.html
-
Size
4KB
-
MD5
94793bae9e13583daab62da6db119d58
-
SHA1
e9171327e0c056f3b6056e014660ac25d452ca89
-
SHA256
f235c713247e39faee106b8e999c6b31beb1237a66635706f59dd5c2fab1cb4d
-
SHA512
d7255caca1cac1c26b6134bde1be04f58fe09cad35575c4504936cf08adf5d1ed69022bfb8873156efc581b6a400b8a71287492913d09991912d326c59c1d83f
Score1/10 -