General

  • Target

    5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

  • Size

    281KB

  • Sample

    220802-c8henaghfq

  • MD5

    a0ad66bbe2af5c64af859ed1b250e145

  • SHA1

    5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f

  • SHA256

    5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

  • SHA512

    ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������36 CF CD CD F7 6E 73 C0 AD AF 14 46 DB BF 94 4B 51 43 9D D0 CE 64 EB 45 70 BB 16 62 88 30 F8 77 D2 26 71 89 E3 D1 88 2B 20 54 7D 33 E6 A7 11 2A 04 F9 EF 57 F0 13 18 56 9C DE 45 2C 8C 80 B4 71 76 46 08 8C C3 8A 8D 68 90 40 14 69 51 B6 A5 BB 99 E8 46 74 86 3B 25 AE 73 A7 68 3C 6D A2 84 9C EB 98 5D 1A E6 82 3A B1 DF 54 B5 FD CD 94 03 1B 1C 19 BF 1F D0 E4 B1 2B 12 B8 3A D0 10 6D 86 CB 5F 32 19 7A EB 9E E7 25 67 28 5F 42 AC 36 EB D6 FF F9 F4 97 5D CC 7D 1C 8C E0 89 59 AB BA 6E 97 71 0F 18 DE BF 88 0A 24 43 CA 12 01 78 2C 76 A9 9C 2E 84 A2 69 28 14 21 17 1B 2D BA 4A D3 5E 4D 9B C9 15 64 3B 8F 72 2C DE 49 19 8C E4 49 B5 C5 B5 05 A4 0B EC BD 0F C7 B8 6B 53 0E 63 00 70 34 B6 47 BC 17 F2 BE 3C 64 08 9F F4 4F F4 4B 84 24 CD 3E 45 CE 1C 23 57 9C A9 EF BB F0 CB 36 EA 27 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Targets

    • Target

      5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

    • Size

      281KB

    • MD5

      a0ad66bbe2af5c64af859ed1b250e145

    • SHA1

      5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f

    • SHA256

      5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

    • SHA512

      ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks