Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter
-
Size
53KB
-
Sample
250305-1c14wsy1ew
-
MD5
71e99529c74cd2203188c802ec1b0da9
-
SHA1
f0bc068e483f703308e5af56aa41060896893381
-
SHA256
3a42c34671b164812ebbb2a299f14ea11c206c9e57773683888239da203e0dff
-
SHA512
ab47ed31944215884d61db1cd1f54bf71e5135ddc7f16ff4aadd547f2409e87ab4038b7400fe83cec1746b084d6377eccbc1dcca1c2de642bd0dfcb0b74883c7
-
SSDEEP
768:qCjDzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5k5MIM:qIeytM3alnawrRIwxVSHMweio3yMPm
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>�����������64 3E 7C EC 6D 2B 39 21 5F 2B BB B2 02 F2 F9 EC
2C A6 51 6F 5E F4 55 E3 43 8D 4A 92 C9 4C 8D 4C
A7 FE 25 D7 24 D5 94 97 C0 B3 DE 68 F1 6F 3B 56
73 07 1D 8B A2 11 A0 52 ED D4 7C D4 BF ED 25 E4
4A DF 89 71 B9 CD 08 AA 7A FB 6A BF 95 D6 A1 D6
54 CE 48 B3 4E D3 12 63 80 3B 6D 02 EC CE CD FF
5B 0A 82 E3 69 AD DC A6 15 B3 05 EE 3F F1 D2 D2
4E 3B 34 C5 5E F0 BF C9 56 CD F0 76 98 67 C8 AE
FF 85 4C F6 09 86 5E 04 59 C8 00 F9 10 41 D0 4B
4C B8 C1 D9 0A 43 A0 82 23 0F 28 D6 EF E0 52 89
6D C8 7C AF 39 16 92 78 67 25 FC A5 A0 D1 EF 7C
D8 26 A8 52 CE A8 85 0A 08 3B F1 B6 0D 91 28 20
1B 0E 0C BD 6B 95 9E E5 B7 B7 B9 28 2A F9 6F 5A
EA 98 5A DC AF AA 6F 26 9A 3A 88 27 72 80 39 A6
7B BA 37 6C 21 43 E6 6D 63 70 7D 33 5F E8 07 A6
53 24 97 A2 1B FB 8F 1A BB 2A 4E 91 4C 62 57 98
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>������������
Extracted
Path
C:\Users\Public\Pictures\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>�����������29 CC F8 C2 D1 8C D3 B0 22 8E 1D FB F9 6E C2 22
A4 F5 DB BA 8B DF ED 09 7A 32 35 C7 65 78 B7 A0
A2 E1 18 6E 34 77 BB C9 E8 53 37 92 F8 09 A2 14
4D 87 9B 41 CB 0C D5 B0 E9 0F FA EA 15 35 1A CF
B8 31 1F 1B 7B 0B 2F 01 9F 98 F7 01 D8 ED 86 05
BA 84 9D B8 0F AF 0B 1C 17 51 59 CD BF 14 9B 11
48 6D E6 E8 85 24 5C 2E F4 D9 A5 6D E5 F6 FF ED
ED 27 4A BB 50 81 2C 5E 72 D7 DF D4 16 44 33 55
B2 EE 42 95 0A FC 02 2E 6D DD 5E 0A 3B F2 C8 A8
1B B5 7C D7 DC CE 93 BF 90 2B 42 35 7D 39 7C 0C
96 0A 54 B4 86 FA 08 2C 1A 68 8E FA DD EB C6 03
10 1F 10 FE 08 0F 45 16 95 7F 46 4E E3 74 B7 C2
47 02 5E 03 01 E3 D6 34 13 76 0B 49 F8 FA EA 99
F3 33 A9 9F DC 69 55 2B E7 80 56 D0 0E CC 4A 2A
F4 45 14 2B 92 C5 FB 54 FE 06 EC 34 45 47 04 FE
DC 1F E9 92 11 27 EC 9B A1 26 CE A4 22 3D 82 A5
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>������������
Targets
-
-
Target
2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter
-
Size
53KB
-
MD5
71e99529c74cd2203188c802ec1b0da9
-
SHA1
f0bc068e483f703308e5af56aa41060896893381
-
SHA256
3a42c34671b164812ebbb2a299f14ea11c206c9e57773683888239da203e0dff
-
SHA512
ab47ed31944215884d61db1cd1f54bf71e5135ddc7f16ff4aadd547f2409e87ab4038b7400fe83cec1746b084d6377eccbc1dcca1c2de642bd0dfcb0b74883c7
-
SSDEEP
768:qCjDzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5k5MIM:qIeytM3alnawrRIwxVSHMweio3yMPm
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (8690) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1