General
-
Target
9634bf20af12b966691a5da0e23e203ade4d630dd7da54a4bca035f542e40144.exe
-
Size
55KB
-
Sample
230225-fslnxscc45
-
MD5
fe86425cab9eaa734756f4046f904add
-
SHA1
b962129668cf1dbee5e62aa7c838c10848f092f1
-
SHA256
9634bf20af12b966691a5da0e23e203ade4d630dd7da54a4bca035f542e40144
-
SHA512
4a9a6fb0cf857dba772f86cd13bc32d03496e55249750330cb5a12e474026fbe05c6b6e5dbe995490ff2f0a79a75651ef2ee591c246d3d13ac346ff315dab3d6
-
SSDEEP
768:MBfhqvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vM2b5:MxSeytM3alnawrRIwxVSHMweio31/F
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\Sample Videos\Read me!.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>[email protected]</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</hta:application></p>
<div class="header"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII=" />
<h2><span style="text-decoration: underline; color: #000000;"><strong><em>All your files have been encrypted!</em></strong></span></h2>
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mails: <span style="color: #800000;"><a style="color: #800000;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #ff0000;"><a style="color: #0000ff;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #800000;"><a style="color: #006400;" href="mailto:[email protected]">[email protected]</a></span><span style="text-decoration: underline;"></span></div>
<p>(for the fastest possible response, write to all 3 mails at once!)</p>
<h4 class="bold"><span style="text-decoration: underline;"><em><strong>Write this ID at the beginning of your message:</strong></em></span></h4>
<p><span style="text-decoration: underline; color: #0000ff;"><em><strong>
��������������19 AF 7E 98 6B 9A 00 DA BE BB C2 BE DC 03 3B CE
15 6A 52 90 A5 A3 E1 94 30 A1 72 1D 7E 74 03 F8
C2 6B B5 7E 21 E0 0F F7 12 5D 03 35 1B AA 16 AE
C9 CC 5A C2 6F 7E 2F 3C 9A F1 4D B8 58 10 86 82
C6 AC A4 BD 86 DB 37 08 27 C2 4B 3C 24 08 B2 51
55 C6 85 E6 4F 61 64 C6 4B A1 BB 40 A1 CC 67 0E
71 2A 73 8B 49 43 4B 16 26 36 78 53 C0 3C DD D4
63 CD FC 54 80 44 5E 97 CF D8 9D E3 AE 39 20 9E
C4 B3 10 5C 38 F1 A1 E5 7E CA 3B 26 77 9D D4 3A
A0 D4 8E AC 41 FF EC EE 46 AF D1 B3 53 0E F6 A5
DE 38 5A 45 CF 57 DC D4 65 CA F6 3C D4 62 C0 DD
5B 05 C7 CE FA 40 78 43 D8 AB DA F2 0E 9D C5 FC
04 66 00 F9 19 A4 F7 3F 8B D9 AA 45 37 94 38 4F
41 79 A0 61 AD AE 01 F2 5D 54 D6 B4 EF C0 A7 A5
AF 1F 38 02 D3 6A 41 9F 9C 58 1B 3A F5 46 EF C4
AC 4E AA A9 22 72 BF 03 76 4F F4 51 FA C2 2F C2
</strong></em></span></p>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>���������������
Emails
<title>[email protected]</title>
href="mailto:[email protected]">[email protected]</a></span> and <span
href="mailto:[email protected]">[email protected]</a></span> and <span
href="mailto:[email protected]">[email protected]</a></span><span
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
Path
C:\Users\Public\Pictures\Read me!.hta
Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'>
<html>
<head>
<meta charset='windows-1251'>
<title>[email protected]</title>
<HTA:APPLICATION
ICON='msiexec.exe'
SINGLEINSTANCE='yes'
SysMenu="no">
<script language="JScript">
window.moveTo(50, 50);
window.resizeTo(screen.width - 100, screen.height - 100);
</script>
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background: #EDEDED;
}
img {
display:inline-block;
}
.bold {
font-weight: bold;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
text-align: center;
font-size: 30px;
line-height: 50px;
font-weight: bold;
margin-bottom:20px;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
.footer {
position:fixed;
bottom:0;
right:0;
text-align: right;
}
</style>
</hta:application></p>
<div class="header"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII=" />
<h2><span style="text-decoration: underline; color: #000000;"><strong><em>All your files have been encrypted!</em></strong></span></h2>
</div>
<div class="bold">All your files have been encrypted due to a security problem with your PC.</div>
<div class="bold">If you want to restore them, write us to the e-mails: <span style="color: #800000;"><a style="color: #800000;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #ff0000;"><a style="color: #0000ff;" href="mailto:[email protected]">[email protected]</a></span> and <span style="color: #800000;"><a style="color: #006400;" href="mailto:[email protected]">[email protected]</a></span><span style="text-decoration: underline;"></span></div>
<p>(for the fastest possible response, write to all 3 mails at once!)</p>
<h4 class="bold"><span style="text-decoration: underline;"><em><strong>Write this ID at the beginning of your message:</strong></em></span></h4>
<p><span style="text-decoration: underline; color: #0000ff;"><em><strong>
��������������7A E5 4D E1 88 25 DC F5 E4 EA 1B BF A4 8C DB 96
8D 47 71 BE C6 F7 4C DB 4D F8 4F 2D 2D 2E CF 64
78 5A F9 47 A6 08 92 EF 55 ED 7C 4F 93 17 69 36
AB 03 91 0F 1F 93 86 92 A6 A2 E7 25 93 90 D2 49
66 6D D3 7E ED 47 25 7A 6C 6B BA B1 0E 81 4E DC
E3 81 12 A7 03 11 7C 0B 4A 6A 13 89 65 16 65 79
65 39 7C DB 01 C1 21 77 28 10 F6 FD A8 BB D5 8F
24 A6 85 0A 27 5F 7E 96 02 63 F8 C9 B2 D9 5D E7
46 32 36 C1 BB 0D 6E 6E 92 11 BE 71 C5 77 EB 39
EE 65 92 66 22 78 B8 93 A9 74 44 95 61 42 9C 9D
3A 2A D6 E6 71 0E 72 93 5C 4F DD 99 D1 57 0E 61
0C DA E3 18 8D 0B D1 E1 7E 13 E0 82 57 1E F1 D6
BF 1A 25 E2 A0 FF 51 8E 4C C0 6C 59 27 E3 6F 9D
91 BF C1 F7 0C 1F 08 22 CA 38 14 10 62 DC 82 93
9E 94 38 18 E7 1F 8B 99 4E 88 6F 41 2E 67 CB 8B
BC FF BA 0A A6 0D 1E 08 15 63 EE 23 C1 62 BF 38
</strong></em></span></p>
<div>
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
</div>
<div class='note info'>
<div class='title'>Free decryption as guarantee</div>
<ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 5Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul>
</div>
<div class='note info'>
<div class='title'>How to obtain Bitcoins</div>
<ul>
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
<br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>
<br> Also you can find other places to buy Bitcoins and beginners guide here:
<br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a>
</ul>
</div>
<div class='note alert'>
<div class='title'>Attention!</div>
<ul>
<li>Do not rename encrypted files.</li>
<li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li>
<li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li>
</ul>
</div>
</body>
</html>���������������
Emails
<title>[email protected]</title>
href="mailto:[email protected]">[email protected]</a></span> and <span
href="mailto:[email protected]">[email protected]</a></span> and <span
href="mailto:[email protected]">[email protected]</a></span><span
URLs
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
-
Target
9634bf20af12b966691a5da0e23e203ade4d630dd7da54a4bca035f542e40144.exe
-
Size
55KB
-
MD5
fe86425cab9eaa734756f4046f904add
-
SHA1
b962129668cf1dbee5e62aa7c838c10848f092f1
-
SHA256
9634bf20af12b966691a5da0e23e203ade4d630dd7da54a4bca035f542e40144
-
SHA512
4a9a6fb0cf857dba772f86cd13bc32d03496e55249750330cb5a12e474026fbe05c6b6e5dbe995490ff2f0a79a75651ef2ee591c246d3d13ac346ff315dab3d6
-
SSDEEP
768:MBfhqvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vM2b5:MxSeytM3alnawrRIwxVSHMweio31/F
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-