Overview

overview

10

Static

static

418a45b6d7...79.exe

windows7-x64

10

418a45b6d7...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579

  • Size

    366KB

  • Sample

    230129-w15d1agg87

  • MD5

    dd065e54805dfc8c1640065803a3fa23

  • SHA1

    e0e3646919b6fdb37fd9d9d70d3c0ef23d46dc1a

  • SHA256

    418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579

  • SHA512

    5f7885acfa03411e743579b537257b68aec67e08babcf035689338663f27be082307e65adced4a7f94a413f44a141b5670872d1791b728d4ef6fb592a2b958b0

  • SSDEEP

    6144:W8afWfuCiCEfwdciYYx8+W5p56UKV4UszE7hvriQi:W6ueEMPvW8UhUszE7hvDi

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������8A D4 44 0E BD A8 22 97 44 6F 0E 4A 5F E9 2E 5C 90 5B 6D D8 7E 3B 6D 8C A3 7B AE BF 29 77 43 9E 6B 40 C1 1E BF 62 BF 27 7E 12 F2 5A F6 EA 33 B5 CF 74 C2 5B 7F 28 C8 07 4D 9D D0 D9 7D A5 FF 7D FF 66 A6 F7 51 43 66 EC E3 37 BF 89 BE 07 25 7C EE B4 BB 5C AE 96 03 67 7B 4C 02 81 BF 50 3E DA C7 BA 6A 7A 8B FE AD FA D3 F6 1C F7 AF 75 86 BF DE 3C 03 EA C2 0A B4 55 92 55 A4 7C C4 7C 17 EB 8A 10 4E 4E 14 22 57 C5 E8 21 7D 86 C4 66 B3 01 22 93 EA F3 BE A2 80 14 49 73 77 DF D6 87 D9 83 C2 E5 8F 48 64 FC 93 D8 2F 8E D1 4C 31 74 D7 69 7D 6D CD 54 35 59 60 9B AA 52 88 EC 37 FF AD 48 9B 3E 3B 3E 19 C1 EB 69 74 04 78 03 AD E9 E5 3D EE 68 4F E5 81 08 33 85 8C E8 DC C3 D0 A8 39 F0 72 83 71 D2 50 8D 58 A2 DA 7D B2 E9 75 A8 C1 B2 47 F8 93 B7 E6 19 FC E9 A1 C9 CA 0C BB 58 14 BB ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������73 91 FE C6 61 D8 DB A6 4E 0E 77 08 D1 D8 E3 E2 AE 9E 8A 1A 12 A2 E0 F2 F1 30 43 BB 8D A3 C4 94 5C 2B E6 1D 3F C6 16 23 E5 F2 D1 F0 41 10 3C 42 1F 86 F7 3E E5 8B 30 CB FE 0E 3D CC F7 A0 1A A3 94 25 B0 28 E8 CD 35 33 79 4A AD A3 8B B5 2A 59 51 36 D2 01 9C 4A BB 5C 52 41 A6 76 2A CF FA 43 B0 C6 1E 87 01 CD C5 66 5A 59 13 B8 84 F0 7A 8A 59 52 6C 23 4F F0 D1 2C 64 A2 FD B1 9A 94 66 E3 2B A8 D8 5B 11 77 F2 6B 93 56 1B DB 3D 92 FB 14 A7 87 6F 44 A8 EA A7 B7 CF DF 8B AD D2 65 A7 92 22 7F AA 67 A2 21 EE 05 3E 45 2C 15 3A 56 5F A0 29 65 D3 5F 9D CD E3 89 CC EA 38 A7 0A 8A 9C 61 57 96 A8 49 F0 60 93 54 D6 72 9D 38 20 96 DF 66 9B 26 4A 9C 90 17 CD 4C 20 00 FE 9B 10 A8 9B 08 B5 D2 60 C8 EF B3 8F 57 F0 2E F2 BF FC A2 3F 10 10 0E 49 96 8A 06 C2 09 7A 0D 3F 35 B7 E0 8A D4 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Targets

    • Target

      418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579

    • Size

      366KB

    • MD5

      dd065e54805dfc8c1640065803a3fa23

    • SHA1

      e0e3646919b6fdb37fd9d9d70d3c0ef23d46dc1a

    • SHA256

      418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579

    • SHA512

      5f7885acfa03411e743579b537257b68aec67e08babcf035689338663f27be082307e65adced4a7f94a413f44a141b5670872d1791b728d4ef6fb592a2b958b0

    • SSDEEP

      6144:W8afWfuCiCEfwdciYYx8+W5p56UKV4UszE7hvriQi:W6ueEMPvW8UhUszE7hvDi

    Score
    10/10
    globeimposterpersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks