globeimposter

General

Target

e27879b1cbd53ab565e049393da99ed5efa099a5eaf1e2595d44bdaea1d60ddf.exe
Size

577KB
Sample

221201-mvxmjaeb8x
MD5

ccd4fc36f74caf6fae7b806ce66a9859
SHA1

7b11c433593ffd98a87bd1ec399a1beb768f5b22
SHA256

e27879b1cbd53ab565e049393da99ed5efa099a5eaf1e2595d44bdaea1d60ddf
SHA512

7266dc50ad201106c99a9b4141a7fa12e28cdc59c1bd10005e76bb7335849f3b88bf58c37d784bfa14d77d2411a97f339fd0ec27e36d47e5ddd434ddfdba1536
SSDEEP

12288:uGQttWvM3zrbETClTkFguiSlqamdqVbnFSPnQxBIyXCD8Hk6:u8U376C1kFgullOo9nGn2BIyXtX

Score

10^/10

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5 ��47 43 2A F2 BD 6D 2B 2A 68 CD E4 11 BD 0B 40 06 FC 31 D7 DE 4F 40 D8 E1 C4 33 40 BC 2B 34 A7 C6 BB 5D DA 54 40 8A 07 63 88 3C 6D 04 28 91 43 5F E0 27 E5 41 AF 7A B3 E5 28 04 4D DE 4B 0A 2A 23 B7 0D 07 60 5E E4 D6 EE A9 25 28 45 F6 2E 21 4E 95 EF 5B D1 8B 4C FB CD 0E 60 19 1F 14 15 E2 5A D8 4A 3D 2B 90 5B 1F 38 B2 03 37 9D 68 39 BC FA 2B E7 9E A1 7D ED B3 6A 95 87 D2 8A B1 B2 09 42 6F B1 B4 58 55 E5 11 89 2E E8 04 D7 65 F7 2A 8B 36 7E E3 C0 AC A5 72 8C 4D 57 49 C1 2A F3 E5 FB D3 40 A3 63 14 F4 7D 8A 5A 6E EA 94 DD 02 B8 C0 45 55 54 63 B1 FF BD 35 EA 3C F8 6F B3 70 8D 34 E9 88 FE 23 A3 E5 68 10 BF D2 D3 6E 88 0A F7 BF FB 2F 35 BF F2 6E 91 9F 16 5F 59 6A 1A CE D2 A0 C1 4F C5 59 AB E4 B5 12 B2 19 5D 21 1A F1 49 E2 EF A0 AA 6A 96 B9 04 8C 28 64 5A C6 CA 8D B3 EC

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR

https://yip.su/2QstD5

Extracted

Path

C:\odt\ReadMe.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?102YQHIABYP 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?102YQHIABYP

https://yip.su/2QstD5

Extracted

Family

redline

Botnet

R102

C2

94.130.179.90:21188

Attributes

auth_value
cc794f9cf73d320cef662bb8cd5878d3

Targets

- Target
  
  e27879b1cbd53ab565e049393da99ed5efa099a5eaf1e2595d44bdaea1d60ddf.exe
- Size
  
  577KB
- MD5
  
  ccd4fc36f74caf6fae7b806ce66a9859
- SHA1
  
  7b11c433593ffd98a87bd1ec399a1beb768f5b22
- SHA256
  
  e27879b1cbd53ab565e049393da99ed5efa099a5eaf1e2595d44bdaea1d60ddf
- SHA512
  
  7266dc50ad201106c99a9b4141a7fa12e28cdc59c1bd10005e76bb7335849f3b88bf58c37d784bfa14d77d2411a97f339fd0ec27e36d47e5ddd434ddfdba1536
- SSDEEP
  
  12288:uGQttWvM3zrbETClTkFguiSlqamdqVbnFSPnQxBIyXCD8Hk6:u8U376C1kFgullOo9nGn2BIyXtX
Score

10^/10

smokeloader backdoor trojan globeimposter redline r102 discovery infostealer persistence ransomware spyware stealer
- Detects Smokeloader packer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2