General
-
Target
2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter
-
Size
55KB
-
Sample
250123-qnaqza1lew
-
MD5
24bc5578c1d10d0942ce19b05143e6de
-
SHA1
9db2d43d5b39adb24544e96b5929a9d27dd340f8
-
SHA256
3f4ddf731036dc41485bdc01e82c94bf77dfbf0180cb000e3c35e9ebf80223ef
-
SHA512
f6546f3f018c8d476888d4b57b7d58e3dbe9b2ce716551aae40cea438e652debdc0ffaf44b70aec2cc4034d5774b0ccbf7a73667cd7161752bddca2fb314d622
-
SSDEEP
1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx0:bOePKs+Na3IrKJolntGDT5XtC0
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>��������53 F9 00 D9 BC EC 2D 9B 89 60 A5 EA DD 5D DC 2B
D5 AF 9D 2F 51 EC AB 6B BE 20 A8 8E C4 9B C8 A7
76 65 84 CD 2A AA 03 33 AC F6 DC 12 0A C7 33 83
2F EB 41 36 95 AA 7E 04 01 1A C6 57 49 71 85 B6
B1 08 7B 45 5F 15 5A A3 09 FC A4 7B 3F CE FD 6A
E4 22 06 34 88 71 D2 5D 39 D2 6E F5 FF AC 67 74
37 68 19 0A 86 95 60 6A 76 C5 B0 EC D1 93 17 A1
84 37 2D 47 4A 84 0D 40 54 8B DC FD 7D 57 01 E7
4C 7F D0 C4 A1 AD 86 89 F8 5D AD BC 14 EF 8D F8
D9 96 43 9F FE 30 33 BF DB A0 EA 95 C9 E4 3C C1
06 53 25 B4 0C 68 7E EC BB 96 F5 75 66 81 C9 E4
CF F3 37 1A 74 72 CA 5A 5A 5C 52 61 17 BA 85 40
60 0E 71 78 0D 65 BE 78 CE 6A 6B C5 07 E7 57 6B
0A 54 90 4A C1 EC 24 B8 72 EF 33 6E 05 C4 C4 69
30 F3 9B B1 A7 CA B2 92 B3 6E 27 40 33 99 49 4E
E7 E9 37 BF E2 8A 10 AA D7 5D 93 8D 0A B4 79 CC
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>���������
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>��������75 3D B9 7F B3 80 4F C9 50 83 59 95 CC B5 4A 7E
F4 F5 FE 41 25 A1 5A AD A2 BE 94 4B E3 CB F4 90
00 64 38 5A 3C 81 70 58 5F 08 E5 2A 81 25 7B 8B
12 EF BF F2 25 81 5C C3 7C 00 FB FB F6 24 5B 8F
89 CA EB 5B E8 DC 84 DF 67 83 2A B4 C3 63 5A 8F
14 4B EA 26 D7 5C 7C 77 28 DD 62 46 B2 C5 F6 F3
45 29 85 FF 09 7A FF CD 45 B0 20 74 41 C2 26 F9
07 C2 2A 44 13 03 45 94 39 F9 30 24 3B CA 36 2E
9A E4 28 DA BC 77 C4 20 D1 05 A5 89 CB 80 36 23
BA 31 F6 9B 5D DF 02 66 9B 0A 0C 46 80 9B 6D 59
A1 84 66 4A A7 FE 55 15 7E F8 E1 34 EE 8F 97 4C
13 BC A3 67 85 8E 06 FB 5A FC 4C 38 22 F8 FB EA
57 E6 8F C2 8E 8D 20 63 AA 16 2D 95 BD A2 9F FA
DE F2 97 57 13 B7 15 C8 F3 63 20 A2 AC 42 BE F8
0E 7D ED 11 1A 9D 9A F6 94 ED 3A 62 15 91 63 0E
9D 2D 39 BD F2 D2 54 AB 70 FF 25 92 A5 20 36 46
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>���������
Targets
-
-
Target
2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter
-
Size
55KB
-
MD5
24bc5578c1d10d0942ce19b05143e6de
-
SHA1
9db2d43d5b39adb24544e96b5929a9d27dd340f8
-
SHA256
3f4ddf731036dc41485bdc01e82c94bf77dfbf0180cb000e3c35e9ebf80223ef
-
SHA512
f6546f3f018c8d476888d4b57b7d58e3dbe9b2ce716551aae40cea438e652debdc0ffaf44b70aec2cc4034d5774b0ccbf7a73667cd7161752bddca2fb314d622
-
SSDEEP
1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx0:bOePKs+Na3IrKJolntGDT5XtC0
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (8709) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1