General
-
Target
2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter
-
Size
53KB
-
Sample
250128-twvmwstrfz
-
MD5
37b9d85115a8883aef54efdb2d1b9feb
-
SHA1
b10523a4db8a65364fac0e96784337fc77a4c74c
-
SHA256
b8f9df31f5f358069fd8c9c2288384e5fedc6db93b52f54c8f96e7dd48c22346
-
SHA512
2751f037a2ff3bd0ab85941e4ce83cd79aab925df04c291451647a5f09461d20cc42bb1d3dd922109b83b056dc3fb7079648f4e018d73d256d7d5184149e4310
-
SSDEEP
1536:WGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8YiodI:zSPKs+Na3IrKJolntGDT5XtdI
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #C1AB8F;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">Attention! All your files are encrypted.</div>
<div class="note alert">
<ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software -
"YASUDA DECRYPTOR"
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li>
<li>If you want to restore files, write us to the e-mail:
[email protected]
In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
</ul>
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>���������������1C 8E 64 D4 38 83 42 35 83 6B 2D B4 2E 07 6F 65
63 94 9D 7B 79 BE 9A CC 3C 75 1A D6 66 15 29 0B
F0 23 70 77 5B 02 55 E5 0C CF 6B 89 B3 E8 F2 1C
F5 F3 D6 F6 82 73 68 AD 61 83 BA D8 EF 82 19 D1
EF BB 63 FC 58 6B F0 62 ED 5B FE 91 AC 63 B0 87
C7 66 C0 3A B8 3D 2F 54 B2 9C D6 7C E7 AE E1 53
54 4F 91 31 B4 26 74 DF 24 B3 6B 97 69 50 D8 9A
56 55 A8 16 B9 3C 4E 11 B8 F8 38 38 BA CD 40 A9
43 EE 8C DB 7B 99 D9 D4 AD E5 F7 01 56 78 B5 30
18 24 54 31 8E A5 25 2C 13 6A D7 A6 32 E2 31 7A
31 CA E5 42 16 3A 96 A0 09 C4 54 77 A0 68 E4 58
E0 0A 46 B9 29 41 7B 99 72 9E CE AA 00 68 EF A4
0B CF 9A 86 DC EC 21 F9 D9 9C 92 2A A0 AD 2B 9F
94 17 32 6B B3 42 03 0E 3E F8 4F 31 B2 C9 76 8E
94 75 2D 31 2A 03 2A B6 FB E3 0B AA A0 99 EA C2
31 46 D8 81 A2 E0 AA 92 CF 5B 97 04 10 57 06 EE
</pre>
</div>
</body>
</html>��������
Emails
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<head>
<meta charset="utf-8">
<style type="text/css">
body {
font: 15px Tahoma, sans-serif;
margin: 10px;
line-height: 25px;
background-color: #C1AB8F;
}
.bold {
font-weight: bold;
}
.xx {
border: 1px dashed #000;
background: #E3D5F1;
}
.mark {
background: #D0D0E8;
padding: 2px 5px;
}
.header {
font-size: 30px;
height: 50px;
line-height: 50px;
font-weight: bold;
border-bottom: 10px solid #D0D0E8;
}
.info {
background: #D0D0E8;
border-left: 10px solid #00008B;
}
.alert {
background: #FFE4E4;
border-left: 10px solid #FF0000;
}
.private {
border: 1px dashed #000;
background: #FFFFEF;
}
.note {
height: auto;
padding-bottom: 1px;
margin: 15px 0;
}
.note .title {
font-weight: bold;
text-indent: 10px;
height: 30px;
line-height: 30px;
padding-top: 10px;
}
.note .mark {
background: #A2A2B5;
}
.note ul {
margin-top: 0;
}
.note pre {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
}
</style>
</head>
<body>
<div class="header">Attention! All your files are encrypted.</div>
<div class="note alert">
<ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software -
"YASUDA DECRYPTOR"
Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li>
<li>If you want to restore files, write us to the e-mail:
[email protected]
In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li>
<li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
</ul>
</div>
<div class="note private">
<div class="title">Your personal ID</div>
<pre>���������������35 FF 26 8E 5B E8 AD 12 8F 8E C2 85 DB 6E 26 94
FD 33 72 14 74 39 D6 2A FE D7 C8 3D FC A9 58 86
6D BA 59 C4 94 A5 2B 10 9B 21 79 37 9A E9 FE 29
F9 70 6D 42 74 CF 6D DD 84 C7 F0 58 91 E2 5C 91
52 FB 89 F9 CB 17 E0 CE A2 A1 24 FF 43 0D 49 CB
5C DB 6D F6 85 D4 5D C5 6A 1D 75 66 42 1F E3 75
00 15 B2 C3 09 F2 F4 18 13 79 AE B1 13 02 40 A1
A7 56 82 F8 71 C5 FC 9C EF B0 EE CD E5 83 55 02
0C 78 7D 5D 36 5C 21 2C 60 AE 8B 54 5D 07 2F 67
01 58 2E AF 77 AF DA 4B BA EB 8B CF E7 8A BE 8E
27 D4 B8 90 54 33 56 51 4B A0 C9 E9 1F 74 9E 82
7F 7F 46 23 EE 36 40 62 74 10 8A AE 92 6D 8C FD
CD CD F5 89 38 5F F0 94 A1 6C E4 37 F4 CD 7D 89
3C 3C 3F 77 69 EC 0E 2A CE 64 F9 F2 E9 40 F3 93
6D 74 60 68 83 DB 0C 9C 3D E4 EA B4 76 35 E8 D8
48 55 8A 99 98 DC EF 14 D8 46 12 F1 10 BA DD 1B
</pre>
</div>
</body>
</html>��������
Emails
Targets
-
-
Target
2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter
-
Size
53KB
-
MD5
37b9d85115a8883aef54efdb2d1b9feb
-
SHA1
b10523a4db8a65364fac0e96784337fc77a4c74c
-
SHA256
b8f9df31f5f358069fd8c9c2288384e5fedc6db93b52f54c8f96e7dd48c22346
-
SHA512
2751f037a2ff3bd0ab85941e4ce83cd79aab925df04c291451647a5f09461d20cc42bb1d3dd922109b83b056dc3fb7079648f4e018d73d256d7d5184149e4310
-
SSDEEP
1536:WGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8YiodI:zSPKs+Na3IrKJolntGDT5XtdI
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (7497) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-