Overview

overview

10

Static

static

5cd02ef954...b2.exe

windows7-x64

10

5cd02ef954...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2

  • Size

    528KB

  • Sample

    220724-rvpddafgek

  • MD5

    22dce5b7daed8cfb14aa9e8e7eed1d2f

  • SHA1

    ad04ba678cdc09526804c6f2a6341b221c9ac73f

  • SHA256

    5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2

  • SHA512

    64cd8f6c65f31e8a6e7db7a9dbb892f36b553ccdf7f4327f06148fd93fc2e50228351b99318daf2512aa00d901791d1b3c997d291a17ade5eb2ffaf224069f09

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������04 74 7E EA 7A 8B 82 F5 32 A3 0A 17 4F 69 07 A2 87 41 5D 24 78 9F 30 08 AB FE F6 66 A3 60 5A 00 FC 39 C9 A6 05 F8 92 21 3C 7C 9C 46 D7 13 7D 1A 72 B1 33 43 FB 1B EE 0D 8B FB 47 46 7B 19 CA FC E9 70 48 D0 3A B2 C8 33 B7 63 68 BB 5A D3 E4 C4 48 3B 01 A2 5E 31 17 67 73 B8 81 21 00 8B 69 35 B0 7E D8 74 15 EC F3 38 A6 B3 CE 66 9D 6D 94 50 45 9E 3B C7 98 F0 D8 D6 7D 8D 11 FA 38 22 FB 5C 53 67 3A BF 41 08 9E 79 13 E6 A4 5D 30 FC 31 CE 65 A6 FF 3E 21 DB FB DD 78 65 41 D9 B0 69 D5 70 D7 8B 62 E3 B7 6D 24 BA 83 CC 8C 41 F6 D2 9B 3D B0 5B 2E 2D 77 53 7F 1F 5F F4 29 8D 09 0D 9C D6 DD F6 B3 60 54 A5 0B 6D 49 D4 43 C2 C5 00 B2 20 B1 06 49 76 24 74 15 4E 6A B9 BD 64 87 00 A5 16 13 EF D6 FE 2E BF 60 EE 82 30 62 8D D2 45 48 63 15 FD 9B 65 6D 2E 43 D9 2F 03 E8 A7 F4 E5 CA D8 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������83 C8 FD 37 E0 37 F5 96 AD E8 24 20 1F 8D C4 DE 9A 4A FA 95 02 D1 57 1F 66 90 FD 33 72 95 1B DD 7D 0E C7 D0 BE 74 1B C8 0A 15 88 4E 8D 3D 48 48 9C 08 1C 1A 67 F8 AB 64 A2 9B C7 A8 71 88 7B 33 0B 70 FB 6F F7 73 98 30 59 B9 92 EC 8C C5 B9 7D 7E 2A 7E 7E F4 E0 AB E0 B0 CC 98 50 14 D9 B0 B4 CB 3E 7D CA 18 55 3B F8 8E 40 20 E5 56 90 2D 89 05 DB A5 6A F2 8B 56 1B 9A 82 82 1E 30 84 5F 25 AA 2C EF 76 38 8C 98 42 96 2C 74 DA B7 F5 9B 58 7C 09 47 47 40 B2 C8 2A 20 52 EC 0A 83 31 25 5C E1 89 6C 87 38 A7 46 55 14 8A 35 90 A6 6D 43 B6 EC 90 F8 2B 8E 8B 5F 90 42 61 9B 6F 73 CC F9 EB D9 5A EE 45 65 24 3F A2 81 EF 14 96 6D BE D7 04 F3 8D 39 94 24 E3 12 2B 52 54 C6 F5 3B 7F D6 57 94 8E C9 3B 22 A4 55 D7 FE 82 4D AB 39 00 07 D6 08 DD 66 29 12 EB 54 26 0A 21 09 EB 71 95 E8 F0 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Targets

    • Target

      5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2

    • Size

      528KB

    • MD5

      22dce5b7daed8cfb14aa9e8e7eed1d2f

    • SHA1

      ad04ba678cdc09526804c6f2a6341b221c9ac73f

    • SHA256

      5cd02ef954d51126f01144c77a353c9362accc62c56a0292e5bb29e0a58901b2

    • SHA512

      64cd8f6c65f31e8a6e7db7a9dbb892f36b553ccdf7f4327f06148fd93fc2e50228351b99318daf2512aa00d901791d1b3c997d291a17ade5eb2ffaf224069f09

    Score
    10/10
    globeimposterlockbitpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks