Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter
-
Size
53KB
-
Sample
250305-1e1adazsct
-
MD5
c6a8f1bad2dd8e9c25b4f172a3d6c907
-
SHA1
ac461efd37d5c032c5ec0f312fcd628358fc7e3b
-
SHA256
1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8
-
SHA512
48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b
-
SSDEEP
768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������0E E4 FC CE 0E D9 05 0F 44 2E BC 91 69 12 BD CF
08 50 52 16 5C 23 7F 1E DF CB 66 DC 0B 2E 15 CA
2F 8A E0 F2 8B 83 21 ED BC 56 6C 81 A3 79 D3 DC
52 97 4E 0B A1 AD 19 BB 48 22 B6 73 1A 92 D0 FC
87 2E D3 BE D1 B7 9C EE 15 99 EB F1 31 40 B6 58
14 96 3A 38 D0 0A CA C1 B6 DE 1B AB BA CF A5 B3
A5 6C 1B 01 28 7D BE 87 8E 66 E3 F5 17 FB 48 80
B2 BD 11 70 F7 97 BA 77 45 32 DA 1A 75 FB C4 5F
9E B2 87 CC 26 DB A3 73 4A 24 AF 40 E4 27 06 89
B2 13 96 F8 FB 7C B8 88 55 2F 78 F4 F7 1B 6A 12
D6 3C DD 91 AE 48 F1 59 46 AC 4D 61 07 F1 2B E1
CB AF 80 88 57 92 C4 D2 C2 C4 A5 08 B8 D2 49 E7
C8 4F C7 ED CE 3F EF 26 3C AD 70 D7 2C 0C 06 22
A3 6A DE E2 0F 5A 1B 40 F8 3A DC 48 E1 CD D3 8F
77 FA 13 6D 9C 48 0B B5 43 EB F1 C4 4D AF 9D E8
86 74 EC 32 97 0B F6 48 C7 13 8E CC 6B 15 42 0E
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>�����������
Extracted
Path
C:\Users\Public\Pictures\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������3F CE 3E 59 D7 EA 36 61 AB 0B 01 F1 24 7B 45 6B
0E 7A C5 CB 35 9E 14 76 8E 22 0B 28 DC 68 24 36
FD A3 64 86 6D 2F 78 50 85 9F BB 39 3D 36 F3 A9
E6 56 CC 95 A5 B5 C9 A8 75 DB A7 52 3B D4 52 EC
67 C2 67 EE 8A 3D FF BE E6 DC 60 57 4C B6 8A F8
19 6F 6F 7D 94 1D 1F C4 14 E9 FC D4 78 82 DF 60
66 64 03 CA B9 8F 76 F6 CA 9F B4 46 96 DA FC 76
AE 53 A0 5C 41 E4 69 EE 33 1C 6C CC F6 2B D0 96
D2 3A 3A 29 24 56 E0 25 5C 6C 12 EC 8A 05 EB 59
76 9D ED 77 48 31 BA 33 54 79 73 18 B4 50 2D 16
DB 52 18 10 60 54 26 8B 9B 0E 3D 5E 97 BF 71 C9
4B 43 05 22 83 32 25 4C 94 18 C4 F4 1E 8E EC 59
3F 74 5E 25 7A 65 E5 BA DF A1 AB FB 7F 46 14 D2
F6 91 B5 10 BF 94 5C 35 41 4D 08 49 1A D2 B7 80
C0 99 FF E3 F6 17 D4 4B 4E 78 BD 49 3E 45 96 4C
A8 52 5E CC 43 99 09 92 44 9A 4A 39 39 B5 55 70
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>�����������
Targets
-
-
Target
2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter
-
Size
53KB
-
MD5
c6a8f1bad2dd8e9c25b4f172a3d6c907
-
SHA1
ac461efd37d5c032c5ec0f312fcd628358fc7e3b
-
SHA256
1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8
-
SHA512
48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b
-
SSDEEP
768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (8674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1