Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter
-
Size
53KB
-
Sample
250305-3q4s2ssr17
-
MD5
8cabf7aad09357ff658e078c01d41dd2
-
SHA1
2377520778ced3e5318cb2dda637ec6f8397a08e
-
SHA256
622d171ff8e947e6a57fff1eb063e40c5b40338dd039e7ce71e613774b4c3cac
-
SHA512
4e8559a352e49f87fa8a80b910785ed06ea5fd59c70e35fa403eeafde314ffc96b515912825d2092572c6f49a3a36db006d747bc62d52df94cf4e40f3417406e
-
SSDEEP
768:5/tvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5InneoT:FVeytM3alnawrRIwxVSHMweio3S
Score
10/10
Malware Config
Extracted
Path
C:\Users\Public\Libraries\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>
<div>��������4E 72 2F 26 07 4B 63 46 2B 16 20 46 69 46 17 18
DF C4 EB A1 70 89 E6 AE D0 06 E8 59 83 F2 CA 0A
74 58 AD 48 BC 19 9A D0 14 40 A0 8D 5A 16 9A 87
70 38 85 F2 D5 6F 06 BB DB 22 63 27 AE 61 35 BD
49 80 C3 F2 0E C4 51 E0 F6 DB C4 F0 E9 14 D1 A2
12 A3 E4 FF 12 39 7D F3 60 7A 95 0D 68 AF 1F 23
AD 8A D8 C3 F9 B5 F5 3A EA 7F EF EA EE FD DD 65
98 DE 15 3D 52 8A 97 0E 25 C0 80 E9 B3 EC 2A 82
51 75 E7 70 34 5C 05 E0 6D E4 28 50 78 4D E3 D1
F5 7A 5B D9 DA 30 2E F3 94 6C 74 F4 44 CB 07 71
D9 70 7C 41 1B 22 41 F3 BF B6 79 79 48 89 8A 6B
4C F2 15 2B 0B D5 D4 E5 E0 D0 FD C5 EB 6A C2 98
8E 2C 33 3D E5 DF 8B 04 8B 3C 4C C3 4B 46 5A 50
6F 9D 26 D7 B6 79 D1 74 E0 5E FF AB 5A 42 4E D9
11 35 C6 02 BA 09 C3 41 B6 73 62 CA 28 55 85 F1
83 0A EE F4 95 3A F4 93 A5 89 F7 F7 D3 B2 68 AD
</div>
</pre>
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span>[email protected]</span> or <span>[email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Extracted
Path
C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\how_to_back_files.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #404040;
}
{
margin: 0;
padding: 0;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs1 .head{
text-align: center;
float: top;
text-transform: uppercase;
font-weight: normal;
display: block;
padding: 15px;
color: #000000;
background: #4A83FD;
}
.tabs1 .identi {
margin-left: 15px;
line-height: 13px;
font-size: 13px;
text-align: center;
float: top;
display: block;
padding: 15px;
background: #303030;
color: #DFDFDF;
}
/*---*/
.tabs{
width: 800px;
display: block;
margin: auto;
position: relative;
}
.tabs .tab{
float: left;
display: block;
}
.tabs .tab>input[type="radio"] {
position: absolute;
top: -9999px;
left: -9999px;
}
.tabs .tab>label {
display: block;
padding: 6px 21px;
font-size: 18x;
text-transform: uppercase;
cursor: pointer;
position: relative;
color: #FFF;
background: #4A83FD;
}
.tabs .content {
z-index: 0;/* or display: none; */
overflow: hidden;
width: 800px;
/*padding: 25px;*/
position: absolute;
top: 32px;
left: 0;
background: #303030;
color: #DFDFDF;
opacity:0;
transition: opacity 400ms ease-out;
}
.tabs .content .text{
width: 700px;
padding: 25px;
}
.tabs>.tab>[id^="tab"]:checked + label {
top: 0;
background: #303030;
color: #F5F5F5;
}
.tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] {
z-index: 1;/* or display: block; */
opacity: 1;
transition: opacity 400ms ease-out;
}
</style>
<head>
<meta charset="utf-8">
<title>HOW TO DECRYPT YOUR FILES</title>
</head>
<body>
<div class="tabs1">
<div class="head" ><h3>Your personal ID</h3></div>
<div class="identi">
<pre>
<div>��������38 03 6F 64 DB 22 D7 EE F3 60 9D 4C B3 F2 59 DD
26 B1 F8 8C 6B 5D 86 15 BB 31 54 AF 92 5F E7 55
A6 CC 45 4C D8 1B EF 3E 4B 5F 5A B8 D0 C5 7C 76
A8 8E D6 C5 9C E4 30 22 E6 BB 90 A8 7C 47 65 16
A0 EB 32 1A 29 B5 74 99 17 71 D3 C3 05 B6 3B D3
DB 57 E5 87 A6 78 5F FD 4B 4A A0 49 C0 E3 25 64
1C A7 69 57 67 A1 19 32 28 FA 65 82 10 85 D3 06
A4 3E 14 D9 4E 94 6C AC 44 5A 4B CC EC 36 61 C2
7D 40 3D 8F 79 F4 DB 40 4D 03 7D B5 D4 45 D0 64
00 EE 2E 31 23 AF 1C 20 0F C1 28 4F F3 41 6A 4F
FA F6 2F 2E 06 14 C2 0C D4 C9 73 27 DE 3E 68 DC
AB A3 86 60 39 41 9C 22 13 51 44 39 47 2C 3A E2
6E 7C 47 1E DC FF E5 86 CA 83 BC 0D C3 83 6F 61
DE 3B FA BC 6E A9 09 00 2C AE 1E 3F 5B 81 B6 2F
40 AA 7B 32 3E F8 99 21 A4 F6 D6 DE 86 66 F9 C6
5B 7B 51 99 B4 F3 92 90 6F A6 AD E8 30 81 E5 E3
</div>
</pre>
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<input type="radio" name="tabs" checked="checked" id="tab1" />
<label for="tab1">English</label>
<div id="tab-content1" class="content">
<h1>☠ Your files are encrypted! ☠</h1>
<hr/>
<h3>All your important data has been encrypted.</h3>
<br/>
<div class="text">
<!--text data -->
To recover data you need decryptor.</br>
To get the decryptor you should:</br>
<p>Send 1 test image or text file <span>[email protected]</span> or <span>[email protected]</span>.</br>
In the letter include your personal ID (look at the beginning of this document).</p>
We will give you the decrypted file and assign the price for decryption all files</p>
After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions
We can decrypt one file in quality the evidence that we have the decoder.</br>
<center>Attention!</center></br>
<ul>
<li>Only [email protected] can decrypt your files</li>
<li>Do not attempt to remove the program or run the anti-virus tools</li>
<li>Attempts to self-decrypting files will result in the loss of your data</li>
<li>Decoders other users are not compatible with your data, because each user's unique encryption key</li>
</ul>
<!--text data -->
</div>
</div>
</div>
<!--tab-->
</ul>
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
�����������
Emails
Targets
-
-
Target
2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter
-
Size
53KB
-
MD5
8cabf7aad09357ff658e078c01d41dd2
-
SHA1
2377520778ced3e5318cb2dda637ec6f8397a08e
-
SHA256
622d171ff8e947e6a57fff1eb063e40c5b40338dd039e7ce71e613774b4c3cac
-
SHA512
4e8559a352e49f87fa8a80b910785ed06ea5fd59c70e35fa403eeafde314ffc96b515912825d2092572c6f49a3a36db006d747bc62d52df94cf4e40f3417406e
-
SSDEEP
768:5/tvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5InneoT:FVeytM3alnawrRIwxVSHMweio3S
Score10/10-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Globeimposter family
-
Renames multiple (7682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1