globeimposter

General

Target

RNSM00307.7z
Size

3.0MB
Sample

241113-v1yqsavrbv
MD5

6e75188020c5ec1ffdc041e11124c72e
SHA1

6559fc7c6e214857ef3c9b7e7e3b03684504cc8f
SHA256

8de80fed294f0d140d03d2032d3007857549e73d30380bd3a7ea16bd8073f55e
SHA512

954b6640be4a49980cf7f7a80d6c0a6f8e64999ba3840e34c6d04479ec7a06ddc0ac458fe940829a9ddf78ed51117347ab614c16e420741f5f31d699209cb495
SSDEEP

49152:3HTDMwebpsC3IhttAhpgjRjU6x4JiPakqZnbnOJAVmT4PYkpTPwkD8jyX4Owa:3HIpL4hwhYQ63akQEA4MPYk14kD8j+wa

Score

10^/10

Malware Config

Extracted

Path

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\0C0A\__READ_ME__.txt

Ransom Note

[WHAT HAPPENED] Your important files produced on this computer have been encrypted due a security problem If you want to restore them, write us to the e-mail: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. [FREE DECRYPTION AS GUARANTEE] Before paying you can send to us up to 3 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 1Mb [HOW TO OBTAIN BITCOINS] The easiest way to buy bitcoin is LocalBitcoins site. You have to register, click Buy bitcoins and select the seller by payment method and price https://localbitcoins.com/buy_bitcoins https://paxful.com/buy-bitcoin https://bitcointalk.org/ [ATTENTION] Do not rename encrypted files Do not try to decrypt your data using third party software, it may cause permanent data loss If you not write on e-mail in 36 hours - your key has been deleted and you cant decrypt your files Your ID: 9*2[0uua#UL7^imrr!HZ67h$1seq7[kXgVW).]O$iGNG42CRKP3j:T9f`WJ?o0uge/7T&Hk;,7sY%PoIdD BW'0?>Kp>aQ\+07!2`E)[m(Z(7=OS'gB"FUd3`#aDM5=7aoqacA(5`TZg^Rt86bYYn3iY<>[T,$oRA(9lI ARlCsS1#8aS+N/#&&KQF5u5\?5`Y<\Z=&^@!`V!cY'fe"BEJ=C1D><q8$7GeV5;QZ9SKfZ9-I5:Va4NAR* K2T@dqi4o)g!![QWZ@F>^m9f&%GU(;AAeK21Zk1)P^2_\O'Gb+*AJ8d""c&,%PnfIJ!h.'N$TY%=@,V

Emails

[email protected]

URLs

https://paxful.com/buy-bitcoin

https://bitcointalk.org/

Targets

- Target
  
  RNSM00307.7z
- Size
  
  3.0MB
- MD5
  
  6e75188020c5ec1ffdc041e11124c72e
- SHA1
  
  6559fc7c6e214857ef3c9b7e7e3b03684504cc8f
- SHA256
  
  8de80fed294f0d140d03d2032d3007857549e73d30380bd3a7ea16bd8073f55e
- SHA512
  
  954b6640be4a49980cf7f7a80d6c0a6f8e64999ba3840e34c6d04479ec7a06ddc0ac458fe940829a9ddf78ed51117347ab614c16e420741f5f31d699209cb495
- SSDEEP
  
  49152:3HTDMwebpsC3IhttAhpgjRjU6x4JiPakqZnbnOJAVmT4PYkpTPwkD8jyX4Owa:3HIpL4hwhYQ63akQEA4MPYk14kD8j+wa
Score

10^/10

globeimposter bootkit defense_evasion discovery evasion execution impact persistence ransomware upx
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (56) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1