globeimposter

General

Target

9527cdac7fc502e825e6a83f601d8352_JaffaCakes118
Size

50KB
Sample

240604-rm4s4aae94
MD5

9527cdac7fc502e825e6a83f601d8352
SHA1

52fbf432e41029f5ddcbbad8b49211688e93f74f
SHA256

6cf11f4d901e8c183ed473dec7673954464d4e9b4516017f53f56ebda7beafce
SHA512

3fad754cd34feedf1e33d09940ccfbed1d3ff2aec036dbd8e094251fcad0af670610e784401cba74075a3f71668500c724164fab2910a0a282a65d7760e43331
SSDEEP

768:tFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5CN:tteytM3alnawrRIwxVSHMweio3MN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��6F E4 F1 84 A3 61 3F 1B 31 D0 D6 C9 FC 96 7E 52 F2 7F E2 70 31 A9 AD 84 2D 30 82 75 D0 67 8C DD AA 8C 44 AA 1F E2 30 03 55 A0 A5 87 3C 8D 90 84 C5 26 1A C7 F2 F6 D8 D6 6D 56 0D 1E E4 DA A2 96 0F 1D 7C 45 69 C8 0C 45 A1 B1 8F 28 04 BE 8D C4 F1 1C A5 5F EA EC 54 56 8D E4 BF 92 33 74 47 E9 C1 7F F1 09 72 CE 37 C3 6D 83 0B 32 A9 D1 09 67 DA 98 14 77 CB 43 1D 3F 50 FC 37 55 55 26 BB 80 91 19 93 BC 69 92 DC FE 30 8E F5 9D B4 E6 AA B2 E9 CA 07 B5 B1 7D 58 E2 48 DC 68 B7 89 46 4E AD 31 72 52 28 A5 45 BE 65 95 99 1C 44 B5 9F 65 6D 65 B4 6F 90 55 E0 BD 94 A1 E6 C4 EE FC FE 23 96 22 1F C2 16 3F CB 97 4D 75 AE 39 09 8E 90 DF 96 40 47 F9 27 E7 54 AF 63 E4 01 00 76 3D D4 D1 31 14 D2 C3 4B 12 E8 55 B0 5D 48 DC 5B 9A 83 26 47 4F 38 72 AA F6 40 D1 7A 8D 1E 75 E2 F3 B6 7D 5F ��

Emails

[email protected]

Extracted

Path

C:\Users\Public\Videos\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��8F FD C9 A5 6E 3C 3F 0B A5 12 47 E9 AD 21 31 DE 93 0F DC D3 FE F4 B4 A7 37 6E 62 D3 A4 A8 FB 19 94 1C F7 90 B3 31 B0 7B 94 2B FA 93 E6 04 64 4D 6F E0 16 52 4A 86 05 3E 7B 2F BD AD 30 04 E3 5B 38 2A 7A 7E FA 2C 2E B4 E7 1E ED FD 2C 48 78 11 CF 2B D1 73 50 3A AC 01 A9 1D 5C 92 C7 C6 F6 46 48 14 D4 F1 90 58 A5 4B 09 98 33 A4 E2 C3 76 E1 4E 71 66 55 74 05 63 38 A1 D2 21 63 9A EC 09 DA 60 B0 89 34 FB F9 C6 AD 8B 70 94 61 80 50 35 DA E7 E9 19 33 8A 43 62 80 81 89 B7 32 B0 AF D4 E5 84 DA E1 0A 2A FE 2B FF 43 39 CB 89 D0 73 99 C9 8C 58 BA 2B 26 44 E4 E4 01 14 C3 B9 94 7C BC 5B 03 19 03 43 23 8C CE 40 80 CD E5 20 4C F2 55 39 6B 04 2F 11 42 03 BF 43 74 6F C3 DE AE C4 C9 5F 33 0D F3 8B 2F D5 26 3C B2 AB E3 17 70 5C 08 8C EE 05 D1 83 F3 78 14 DA 57 DC EB 38 2F A3 FB 0E ��

Emails

[email protected]

Targets

- Target
  
  9527cdac7fc502e825e6a83f601d8352_JaffaCakes118
- Size
  
  50KB
- MD5
  
  9527cdac7fc502e825e6a83f601d8352
- SHA1
  
  52fbf432e41029f5ddcbbad8b49211688e93f74f
- SHA256
  
  6cf11f4d901e8c183ed473dec7673954464d4e9b4516017f53f56ebda7beafce
- SHA512
  
  3fad754cd34feedf1e33d09940ccfbed1d3ff2aec036dbd8e094251fcad0af670610e784401cba74075a3f71668500c724164fab2910a0a282a65d7760e43331
- SSDEEP
  
  768:tFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5CN:tteytM3alnawrRIwxVSHMweio3MN
Score

10^/10

globeimposter persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Renames multiple (8577) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2