General
-
Target
2025-02-13_11e571e1623676508dd91c9d9785cb75_globeimposter
-
Size
53KB
-
Sample
250213-a8trks1mbt
-
MD5
11e571e1623676508dd91c9d9785cb75
-
SHA1
a11dce4808467f9351f7a9f1a5a553cd6ca68682
-
SHA256
8a0ca1931850dacfb6f74bbbe7ca4f798c238005ede51a76cf894796783dccfc
-
SHA512
4c3cf3480fadba81989ba8f3f79c4ec0193c0d00de59f5284c7daad2bb9b0cf24484102064102ea7932ae4192e9ae50c413afb5c6d4e13967398be2624764b67
-
SSDEEP
768:uTH1kvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5v5E9r:s2eytM3alnawrRIwxVSHMweio3Z5i
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������70 CB 7A A1 FA 8A 8B 2A 5E 9B B7 E5 54 3D 37 45
60 B6 62 E2 3C 52 D0 BD E3 76 65 AA 66 6A D5 81
B2 C7 2B C4 D2 FC C7 FD 98 13 2F E7 3D 4C AF D6
30 8F F4 FD F7 D3 11 B4 19 3E D1 7E 20 F7 F2 80
CF B9 BA B5 EA 09 97 80 E5 50 63 3C FA 1E 73 5C
4C 9C 53 C9 F3 21 64 4B B0 E6 D2 71 E9 1A B2 3B
36 7F C7 6F 2B 17 42 59 02 90 6E 4A 39 E2 78 0E
37 36 B7 85 09 7B E0 43 8A EC 80 CB 92 12 BE 08
4B A7 6B 31 78 16 06 CD 9F F1 1E 87 64 EB FB 51
F6 03 3D 1B 89 F2 A2 AD DA 4B FC 4F 35 6E F5 4D
9F 53 42 CE D9 E2 B5 27 93 D7 A3 08 22 5C AD 61
5B F7 FC 44 99 47 21 88 E0 AD 7D C5 D7 C3 76 A6
8B F6 10 36 D2 5F 35 38 D8 1F 32 6E 1C 2E 6D 7B
8D 3E 86 E2 9E D0 0F 7A FA F6 C0 84 FB A5 FB 9D
1C 10 4A 10 A3 8D C0 C0 69 29 33 EC 6B A7 FA 42
66 62 EE 86 8C 01 25 36 DA 73 D0 88 00 EE EB B2
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>������
Emails
Extracted
Path
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
word-break: break-all;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">��������������28 58 41 9E F3 3F 0B 74 C0 54 8A EC 8E 79 F8 64
70 38 A5 C6 70 BB 07 FB 5C F8 E7 B0 F2 08 8C 6A
7A 55 73 27 D1 11 22 E7 8A EB 28 C5 69 E1 C1 9E
9F 4E 99 DB CF A9 21 0C 8C 47 BD D0 3D 89 66 8C
E2 82 6E 05 27 76 F3 1A 36 56 FE 3C BE 92 EE 93
F0 4C 7F 40 4D 9D 21 6B 71 6E 97 24 3D 7C 3C 7D
4D 0F 9E 23 F2 BF A4 35 EB 09 18 D1 44 96 79 18
B8 52 95 37 40 44 A5 1C 8C 8A D2 43 34 B6 F8 EE
F6 24 75 D8 A4 EC 09 75 BB E8 FC A8 8F 36 53 7A
C5 4D D8 4D 00 10 8A 39 59 B2 CD 82 01 A9 9D 23
5E 55 1B 63 EF 38 E0 96 F9 FF 96 61 03 F9 FD 19
02 41 5F 3F 87 4E 46 67 A2 FF EB 98 52 1C 58 E4
5E 10 97 67 06 2F DC C1 A9 EF 72 13 17 CC 0F 61
53 E7 80 11 D0 1A A7 0A 8C 8B 6F 2B FA 72 63 41
D8 CC BD A4 03 51 82 03 39 0A 70 7B AF 6B 23 A0
6F A9 ED A4 CF DC 79 D0 82 34 66 3D 69 88 BF 48
</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<hr>
<b>email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href="[email protected] ">[email protected] </a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
<p>* Tor-chat to always be in touch: <a href<a href<b>
</div>
</div>
</div>
<!--tab-->
<b>
<b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span>
</b><br><br> </b><br>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>������
Emails
Targets
-
-
Target
2025-02-13_11e571e1623676508dd91c9d9785cb75_globeimposter
-
Size
53KB
-
MD5
11e571e1623676508dd91c9d9785cb75
-
SHA1
a11dce4808467f9351f7a9f1a5a553cd6ca68682
-
SHA256
8a0ca1931850dacfb6f74bbbe7ca4f798c238005ede51a76cf894796783dccfc
-
SHA512
4c3cf3480fadba81989ba8f3f79c4ec0193c0d00de59f5284c7daad2bb9b0cf24484102064102ea7932ae4192e9ae50c413afb5c6d4e13967398be2624764b67
-
SSDEEP
768:uTH1kvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5v5E9r:s2eytM3alnawrRIwxVSHMweio3Z5i
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (7534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1