Overview

overview

10

Static

static

3

2025-02-13...er.exe

windows7-x64

10

2025-02-13...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter

  • Size

    50KB

  • Sample

    250213-kclffawnct

  • MD5

    700edcce509ddcb71a31d1b3765004c2

  • SHA1

    0a19d5d16d772853e0ae32d8ccf09454b51bbfc2

  • SHA256

    1ad20ff4f0ba0af89d3af59c4e9d6015df5b4ee90472f576a4dd578c5bff4c84

  • SHA512

    12558b1c47813b3049e99e80e0649b9aa7ab0eec8796f965969fb9b30d742e68e9b3915a8a209e3cc53e8a7ad1bee27e342115b4f3c89aa26f0025df2bbaf03f

  • SSDEEP

    768:fqAFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5uF:zeytM3alnawrRIwxVSHMweio3

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter

    • Size

      50KB

    • MD5

      700edcce509ddcb71a31d1b3765004c2

    • SHA1

      0a19d5d16d772853e0ae32d8ccf09454b51bbfc2

    • SHA256

      1ad20ff4f0ba0af89d3af59c4e9d6015df5b4ee90472f576a4dd578c5bff4c84

    • SHA512

      12558b1c47813b3049e99e80e0649b9aa7ab0eec8796f965969fb9b30d742e68e9b3915a8a209e3cc53e8a7ad1bee27e342115b4f3c89aa26f0025df2bbaf03f

    • SSDEEP

      768:fqAFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5uF:zeytM3alnawrRIwxVSHMweio3

    Score
    10/10
    globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Globeimposter family

      globeimposter

    • Renames multiple (8692) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks