General
-
Target
2024-11-06_d92e2ce7b037b0262fe54f34f31c9a02_globeimposter
-
Size
53KB
-
Sample
241106-fdks3svdpc
-
MD5
d92e2ce7b037b0262fe54f34f31c9a02
-
SHA1
dcc0d62f6e597d18892fa4c806e1d5fc2bd21f1e
-
SHA256
056d2a70972fc128313ae86028951f9aa98cdccdbb1f0bfca5a7870baa1a19e3
-
SHA512
d14ffff6716143274ffb71c664e4da76d947bf8f1acd59cc0ae32d88432b0bce3102f7c368bad3b2bd5cea8dbd1ef70cf44c10642e70fa09f33a3ced31791962
-
SSDEEP
768:uTHaTvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5v5E9r:NHeytM3alnawrRIwxVSHMweio3Z5i
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������74 76 4F AE 3E 35 43 2E 37 61 33 30 8D 46 97 0B
8D D9 89 5E C9 F4 A2 A3 7E 03 E9 71 A3 D6 B4 1C
51 43 4E 0E C2 ED 38 C1 38 96 04 1A 83 43 78 63
1D 45 EC E8 A6 7F D6 85 57 2F 53 E7 44 C5 41 14
56 AF 50 92 6A E7 8C E1 F9 A0 F8 24 40 E5 47 47
14 FD 32 93 98 7A A7 D2 22 8D EE 64 20 66 A9 B9
D5 1E 9A AD 96 EA 39 45 B0 AD 85 9B 50 BB 94 5A
DC 44 9F E0 90 67 21 94 32 28 D3 4F 10 D0 B1 AC
1E 71 F6 1C 4A 48 CF 19 AE 24 F8 6C A1 CC 8E 5A
AD 95 4C D5 6B 2C FC 20 36 04 EE B5 7D CF AC 35
86 72 B0 29 05 8F 71 90 EC 1E A7 7F 49 B6 5F 17
4E 7E 34 70 05 D5 7B 35 4A 07 46 FE 11 2E 16 48
D5 74 CD D7 41 8C DE B5 8E 44 8F E7 88 28 BD 72
B5 0A 03 94 FB 2D 4B D0 C6 E7 51 B6 64 DE B5 9C
5E E1 7C F7 69 B1 2C DD 92 44 A7 E7 FC AD C8 4D
FA 39 DD BB D7 D3 E1 CD 9D EC 36 C8 27 AE 45 42
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>������
Emails
Extracted
Path
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������19 AF 63 7D 34 17 DB 34 0E B7 73 32 AC 06 95 38
95 94 19 3F EC 02 C8 BD 21 A1 8C 3F C0 9C 02 3F
58 0A EA 76 63 92 EB 51 CF 53 A4 32 32 1E 73 7E
AC 4A 2B 2A FE DB AE 4A B1 BC 0C 16 E3 53 ED FB
37 68 A8 16 6D C2 6B 4D D7 C7 AD 3F 60 09 87 D6
60 96 F4 8B 7F 29 22 C4 88 15 7F 44 80 4F 8A 0F
7B 1C CE 7F 7A F9 EA 2C 02 85 3D 43 71 ED A4 82
8E E9 B5 FC 65 B7 9E 0C D6 80 28 F1 05 D5 61 80
5E F0 D5 8F 39 E3 90 8F 72 CD D5 9D 05 93 75 99
7E 75 22 0E 34 D8 F1 41 46 99 51 DB 6F F9 CC EA
70 E5 38 D9 58 7B B3 2E 6B 44 6B 21 D0 8F F1 F1
AD B6 EE 14 9F 68 F3 95 D4 43 8E 50 33 DD 44 17
33 29 96 E3 04 C3 78 58 B1 A1 2E B0 10 7A 61 8F
42 B1 21 90 77 94 95 6A 2C 2D 9E BC 94 9A 00 3C
03 03 01 FB B0 9C 80 5A 62 20 23 1A 29 17 41 9A
FC 00 24 BB 5A 40 CE F5 12 27 5D D6 D9 A2 71 05
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>������
Emails
Targets
-
-
Target
2024-11-06_d92e2ce7b037b0262fe54f34f31c9a02_globeimposter
-
Size
53KB
-
MD5
d92e2ce7b037b0262fe54f34f31c9a02
-
SHA1
dcc0d62f6e597d18892fa4c806e1d5fc2bd21f1e
-
SHA256
056d2a70972fc128313ae86028951f9aa98cdccdbb1f0bfca5a7870baa1a19e3
-
SHA512
d14ffff6716143274ffb71c664e4da76d947bf8f1acd59cc0ae32d88432b0bce3102f7c368bad3b2bd5cea8dbd1ef70cf44c10642e70fa09f33a3ced31791962
-
SSDEEP
768:uTHaTvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5v5E9r:NHeytM3alnawrRIwxVSHMweio3Z5i
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (7520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1