Overview

overview

10

Static

static

10

_ing_.exe

windows7_x64

10

_ing_.exe

windows10-2004_x64

10

how_to_bac...s.html

windows7_x64

1

how_to_bac...s.html

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    3f76e1891af1dad5c01eda9273e624c48688062b76fd1a496e7dc087cbba46e3
  • Size 30KB
  • Sample220701-bxc55aedcr
  • SHA256 3f76e1891af1dad5c01eda9273e624c48688062b76fd1a496e7dc087cbba46e3
  • MD5 SHA1 SHA512
Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Ransom Note
  • Your files are encrypted! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. To start the recovery process: Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked). Send a email from your new email address to: [email protected] with your personal ID. In response, we will send you further instructions on decrypting your files. Your personal ID: It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time. Check the folder "Spam" when waiting for an email from us. If we do not respond to your message for more than 48 hours, write to the backup email : [email protected] ----------- Q: Did not receive an answer? A: Check the SPAM folder. Q: My spam folder is empty, what should I do? A: Register email box to protonmail.com or cock.li and do the steps above. ��������

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Don't worry, you can return all your files!<br> All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br> The only method of recovering files is to purchase decrypt tool and unique key for you.<br> This software will decrypt all your encrypted files.</center> <br> <center>----------------------------------------------------------</center> To start the recovery process: <ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked). <li>Send a email from your new email address to: <strong> [email protected] </strong> with your personal ID.</li> <li>In response, we will send you further instructions on decrypting your files.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>������������3A ED 54 CC AD A2 0B 42 E3 64 E1 09 D5 F6 61 C5 C7 2B 85 CF 02 28 A0 B9 7E F4 D1 FA CA 18 06 54 3F 48 D3 C6 38 11 A6 08 10 3D D9 AD 2D 02 9D 43 3A AF C1 2F 79 8C E0 4B A2 BC 4B F9 D2 9C 81 3C 67 70 47 CD A4 DC DD F0 8E EA 4E 31 37 1F 33 8F 06 D4 10 F1 47 8E E9 74 DD 9A 9C 30 1C 92 67 28 12 5A 04 C7 FE 6B 28 41 12 C4 84 CA 68 DE 93 32 E3 7A 47 EA 96 F9 78 77 35 46 95 DC AF ED 95 78 EF 11 E2 81 BC AF E0 16 CD 6B F1 4B 88 F4 9D C3 7E D2 F3 6D 60 6E 41 86 B8 BA 0D F7 F9 86 56 EE 81 6A 28 1E 24 3B 7A D9 A4 16 3F E3 BE 0E AB 59 2A 2A 68 A2 E0 BE F5 DC CA E3 F5 A9 B9 95 A7 8D B0 02 B1 FB 8E B6 2E 2C A9 BE E3 A8 93 C1 FA EA C3 1A 39 1F 39 91 A1 97 59 74 7B C3 EF 2D 79 3B D3 46 19 46 72 69 74 64 6D EB 21 29 37 2E D5 E8 2C E6 75 9F B8 0E 1E 36 3F 26 F0 00 E9 10 7F 17 </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>Check the folder "Spam" when waiting for an email from us.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li> <li>-----------</li> <li>Q: Did not receive an answer?</li> <li>A: Check the SPAM folder.</li> <li>Q: My spam folder is empty, what should I do?</li> <li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul> <!--text data --> </div> </div> </div> </body> </html>��������

Extracted

Path

  • C:\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Don't worry, you can return all your files!<br> All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.<br> The only method of recovering files is to purchase decrypt tool and unique key for you.<br> This software will decrypt all your encrypted files.</center> <br> <center>----------------------------------------------------------</center> To start the recovery process: <ul><li>Register email box to protonmail.com or cock.li (do not waste time sending letters from your standard email address, they will all be blocked). <li>Send a email from your new email address to: <strong> [email protected] </strong> with your personal ID.</li> <li>In response, we will send you further instructions on decrypting your files.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>������������81 53 61 1B 1E B6 51 A1 E8 C1 73 43 E3 91 91 F6 59 6C 74 10 04 13 FB 64 DF 8B 39 2E BC FC 4A 4D 20 09 67 17 DF 7B C7 16 11 B9 FD C5 69 5F 1A BF 41 E2 C9 CC 62 CA 22 6D AF 41 63 1C 63 2B 90 48 C1 B5 4E D6 00 B3 1F CA 18 27 BC D8 4F 17 F2 D3 FA E3 EF 9D BF E7 38 E9 B2 F6 F3 60 1E 38 67 AB C6 CE 86 4B DA B3 EB 85 25 02 4A 58 19 35 66 4D 42 DF 6F CA 3E 25 45 E1 3F E1 87 1C 30 B3 0E 5D F2 C3 05 36 41 12 09 F5 CE 34 99 6E 46 51 8E 2F 5E FD A6 A5 1E 56 56 D6 39 10 FD 04 45 BA CA 66 35 4D 38 AF DF 36 06 61 08 DC D2 EB A4 37 D6 7E 3B 8A B0 07 66 29 0E E1 E8 83 28 9C 1F 7B 8E F3 11 CB DA 68 56 89 E7 B4 9D 9C 64 05 0F 2B 2C C4 52 11 46 0A 14 3A A2 45 BB C6 96 60 EB F1 1F 9A 9B 0E 2A 1F FE EC 4E A5 B8 9E D8 8F 3F 88 4C 17 5A 8C BC C0 58 CF A4 97 DA E3 B6 C0 5D 7B 0A 4F </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>Check the folder "Spam" when waiting for an email from us.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li> <li>-----------</li> <li>Q: Did not receive an answer?</li> <li>A: Check the SPAM folder.</li> <li>Q: My spam folder is empty, what should I do?</li> <li>A: Register email box to protonmail.com or cock.li and do the steps above.</li></ul> <!--text data --> </div> </div> </div> </body> </html>��������

Targets

    • Target
      _ing_.exe
    • Size 53KB
    • SHA256 e0e0c26b78f258324345886b83c8a0b6bf6b8ccdf5412c5dfdc10141932090ab
    • MD5 SHA1 SHA512
    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2
    • Target
      how_to_back_files.html
    • Size 4KB
    • SHA256 f235c713247e39faee106b8e999c6b31beb1237a66635706f59dd5c2fab1cb4d
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks