Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter
-
Size
53KB
-
Sample
250305-1g342szshz
-
MD5
c6a8f1bad2dd8e9c25b4f172a3d6c907
-
SHA1
ac461efd37d5c032c5ec0f312fcd628358fc7e3b
-
SHA256
1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8
-
SHA512
48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b
-
SSDEEP
768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Videos\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������8B CD BD 26 61 E2 A7 E3 5A D4 99 0F 88 81 6D AC
99 37 6C D5 B2 74 37 FD 61 38 52 BD 54 84 51 D4
0C 72 F2 35 1C 02 0A E5 38 19 4B 6E D4 EE 76 3C
13 F5 FF BC 44 10 A3 7E 50 B9 94 DA 1E 5E AA 77
79 38 8B 0E 0A 5F 5F 77 EA 1A 18 E8 4B 45 08 27
2C 7A 7D F0 EC AB 80 65 96 20 E6 BF 0F 6F 6B 88
85 ED 8C 5E 89 88 10 F1 BD 7C 36 5F 95 F6 BA F6
5B 54 1B F4 2F 95 44 E6 2A 3E 69 34 EF D8 17 16
E1 17 99 7A F7 56 D0 C2 F9 88 AF 67 8A B6 42 8A
18 53 35 BC 4E 95 E9 FE D7 7E 66 40 4B 66 75 EF
9C 2D 0E 9A 48 CA 82 81 A4 3E 8C DB CB 5B 06 2D
B0 57 9E FD 3A AA BF 6E FC 00 F3 09 CD C8 66 CB
92 15 12 B1 1F 10 42 AA B1 E3 CE AC 3D 29 5B 75
CC CC 8B 85 2B FB C9 69 8F B1 A3 46 C5 72 2F 22
C6 BD 80 06 E7 FB 71 B0 15 2C 87 D8 9E DD 98 50
00 EF 83 41 82 0F 04 64 97 14 24 32 32 B3 93 0F
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>�����������
Extracted
Path
C:\Users\Public\Pictures\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #ff0000;
}
.tabs1 .identi {
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
/*height: 30px;*/
background: red;
}
.tabs .tab{
/*float: left;*/
display: inline-block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 15px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #ff0000;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 100%;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
outline: 1px solid red;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="on" id="tab1" />
<div id="tab-content1" class="content">
<h1>Your files are encrypted! </h1>
<hr/>
<div class="text">
<!--text data -->
<center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br>
Without a secret key stored with us, the restoration of your files is impossible</center>
<br>
<center>----------------------------------------------------------</center>
You will be able to restore files so:
<ul><li>To contact us by e-mail: <strong>
[email protected]
</strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li>
<li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li>
<li>You pay and confirm payment.</li>
<li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul>
<center>---------------------------------------------------------</center>
<strong>Your personal ID:</strong>
<pre>������20 78 B2 8D 12 7F 78 CF 1B AF 4B 96 DA C4 54 7D
AB 98 A3 0B 8D CD 12 D5 6D 13 4B D2 CC CE 17 D0
FA 87 2F BC BC 0D 06 CD 97 8F 66 30 37 40 C4 62
13 60 35 65 23 71 41 0E 68 7A D0 B6 18 44 24 46
C6 9F C7 9D FF 55 05 78 3E 7C 56 06 4A DE AE FB
61 8A 55 F2 30 67 23 67 C8 F5 84 3F 2C 3B 8E 21
7F 95 1E 44 37 CE AF DF 56 EB B7 F5 E6 D4 6A 9E
8C EF 7E E5 96 05 74 F3 1A 6F 0A 51 67 C6 73 1B
76 89 70 EC 2B 94 43 38 1E 07 C2 D3 A6 BE ED 25
1B E2 1F 6A 86 17 EC 28 93 76 B4 F5 51 03 FA D2
29 E1 66 FC 15 32 9F 0C 09 9E 4C 34 1B 37 62 7A
0E 39 F8 1D 74 B8 A0 4F EC E2 BB 90 6D D7 DC 9D
C9 D0 30 A9 6F F6 58 23 56 B4 C3 4D 8A 5E F5 20
7F C3 5C F3 F2 6F 4A 53 ED 4E 1F 7E 33 51 D7 EF
FF 45 BC 33 1C 9C AB DA C9 81 5C D3 58 FE A6 6A
A4 13 8E CB 3E 0E 51 C5 76 31 2A F7 81 D8 9B 5B
</pre>
<center>----------------------------- P.S. ----------------------------------</center>
<ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li>
<li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong>
[email protected]
</strong></li></ul>
<!--text data -->
</div>
</div>
</div>
</body>
</html>�����������
Targets
-
-
Target
2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter
-
Size
53KB
-
MD5
c6a8f1bad2dd8e9c25b4f172a3d6c907
-
SHA1
ac461efd37d5c032c5ec0f312fcd628358fc7e3b
-
SHA256
1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8
-
SHA512
48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b
-
SSDEEP
768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (8665) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1