General
-
Target
2024-09-30_522e839f0581331b49e657ed1b7d07be_globeimposter
-
Size
53KB
-
Sample
241121-nzm5bswnfj
-
MD5
522e839f0581331b49e657ed1b7d07be
-
SHA1
96c0693071dadaec7ab413468cd1692641a876fa
-
SHA256
87a9cf743545b76277e88442e784f0dda6701fb10abfba6c0adc75feaec3de28
-
SHA512
47ae3120496d56a0796269dd08b9d5a6cae6732fa9b591a2507531e05402154b8529ca5b4616d04df92cca2596a39c330a45b8fb92f49fde3cd99df900e73fd2
-
SSDEEP
768:lTH9vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vvVv:feytM3alnawrRIwxVSHMweio3Z
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������83 B2 BD 6C B2 11 22 35 BF 1B A0 6D 41 49 B9 C1
7D F2 34 C9 7E 0B 2C 3F 95 07 51 64 76 CE CC BD
DC 18 FF FB 78 B0 C4 15 B6 4C AD BF D7 71 E7 37
3D 75 8C 9E 33 6C 72 53 8D DC F9 45 A5 C7 28 D4
5C 56 DE 76 F1 48 7A 8F A1 0B 97 F4 CB A4 D5 6E
4B 2F DA 91 32 ED 95 C1 61 DC E5 40 C8 16 55 1D
0C B7 32 7D 59 86 36 37 21 F5 3E B7 DB A3 71 3F
4A 07 C0 56 55 1F 42 F3 FA 13 2A 8B AE 80 BF 21
63 88 96 A1 FA F3 4E 23 78 64 3F B1 12 49 3E 4B
6A 39 E6 58 06 EC 29 1F 21 33 D2 7B B6 DB FC DD
BA 37 CA 51 EE 38 7C FC 11 C3 1F 22 26 6C A8 83
3D 8C 0D 36 91 24 50 5A 21 91 FF 3E 7C 02 10 4A
87 04 86 7E AD B2 B1 89 22 00 30 20 C0 69 2B FC
E6 DE 83 72 89 A1 30 F8 B2 D5 4C EE 33 FC 35 E7
38 59 5B F8 1E 07 46 3A 1A 5C BC 38 21 72 03 63
C2 DF 77 D2 91 0B 28 FA AA 50 15 CC 2D D1 77 B3
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px"></span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
��������
Emails
Extracted
Path
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������6E 39 F4 AB AB F6 48 10 4C EC C3 2E E7 9D 8D 71
C3 28 C1 16 21 50 1D E4 F3 74 FE 9C D8 F6 AB 46
16 24 C0 93 06 2E 0F 89 CE 0A 30 B5 57 60 CE A7
44 4E 13 05 14 DA F4 6A 50 A6 EA 0D 1D D5 90 CC
A6 2F FF 10 73 61 FD 19 30 76 DC 6C C3 73 4C FF
70 4D 54 B0 2C CF 3F 92 D7 77 48 84 A3 56 9E 69
8A 4D 9E B1 D3 3B 3F BB 28 0C D9 D7 8C A5 CB 60
DA 40 CA 5B BE 36 6C 38 63 E6 F8 45 7C DA 4B 79
9E 67 A8 50 A0 DB FA 9A 48 81 58 BE A2 40 AE 9D
D2 66 DA 77 A2 5B 8A 98 A2 8B 17 E3 9C 6A D3 DA
4C FF 4A D0 94 C1 C3 2A AD DE 79 96 7C 30 9E 58
A8 47 25 A3 C1 73 B5 81 5B C3 D0 97 08 88 74 DD
B2 23 06 06 00 BC C1 D3 FB 66 43 55 03 CD 95 4B
BD 55 D0 23 81 BD 22 08 83 98 F9 5E 2E 8D D2 C0
88 82 44 23 CD AE 58 10 B9 14 0F 8F A7 6B D6 36
DB DB 0A C8 7A 99 E4 50 3D 36 98 C1 98 81 E3 CB
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px"></span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
��������
Emails
Targets
-
-
Target
2024-09-30_522e839f0581331b49e657ed1b7d07be_globeimposter
-
Size
53KB
-
MD5
522e839f0581331b49e657ed1b7d07be
-
SHA1
96c0693071dadaec7ab413468cd1692641a876fa
-
SHA256
87a9cf743545b76277e88442e784f0dda6701fb10abfba6c0adc75feaec3de28
-
SHA512
47ae3120496d56a0796269dd08b9d5a6cae6732fa9b591a2507531e05402154b8529ca5b4616d04df92cca2596a39c330a45b8fb92f49fde3cd99df900e73fd2
-
SSDEEP
768:lTH9vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vvVv:feytM3alnawrRIwxVSHMweio3Z
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (7272) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1