globeimposter

General

Target

2025-04-03_4ca5c62cc636a403bab9fec77529ba89_globeimposter
Size

53KB
Sample

250403-3c1t8symy9
MD5

4ca5c62cc636a403bab9fec77529ba89
SHA1

59cf62d60a1becdb0d7d8fd405776494a447a25d
SHA256

7c77c34d63bb5912a2e6a2d3081158b244a42fe05b8366a127aa85568fb33825
SHA512

4ae127f264ecca59707c72df92445df499eeccc545e992cabba988885b1ce09d44f7d8b97960b774161aecc7565e7556ca5f88d49f4ed9d998792b0928664db4
SSDEEP

768:3Qvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5xxKtE:3qeytM3alnawrRIwxVSHMweio3x

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��8B AB AE 2B F0 B0 79 14 5F 50 EA AA B9 FE D5 6B 62 05 C0 44 6E 24 12 F9 47 8E 7F 45 B5 BC 1B 4C 1D 45 E5 E3 77 D3 01 80 D9 D2 21 7F C0 6A D7 99 BE CA 6B 64 9C 78 BC DE D4 28 37 F9 51 73 5A A0 AB AA AD B4 0B 66 7A 10 85 25 C7 97 5C 32 4A F1 CE F4 CC BD 0A C3 95 27 E5 A7 6D 22 93 04 2F C9 93 6A BD 0D 82 52 4C 87 0F 1B 64 BB BB 25 89 8F E6 52 C4 99 20 BE 35 21 2B C0 D7 C9 FB 3B F6 00 E5 BA D1 04 7D 5F 9D 4E 41 8C 39 4A E4 4F 11 AB 12 BF 8D C7 0A B7 5A 37 C9 D5 90 D3 E9 2E C4 38 44 BD B4 C1 48 D3 56 72 5B 9C 26 A2 DD 6F 64 F0 41 FA 91 2A 2C 4A 6F 07 EB 69 8A 09 39 F1 5B 4D 02 74 59 47 93 EF 8A 45 A6 F5 89 C3 4E 17 E4 CA 74 D2 DE BB 08 A6 FC 36 B5 C0 4C 5E BF 44 67 F5 69 FA 4C 8A ED 0A AB 4F 4D 2A 85 72 09 D6 BB 13 25 DC 90 76 F9 14 D3 33 31 5C 4B 34 87 E5 A5 36 </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☠ Your files are encrypted! ☠</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text">  To recover data you need decryptor.</br <p>The cost of the decryptor is 1600 usd. Payment is accepted only in bitcoin (BTC). You can buy bitcoin at your bank or from private currency exchangers</span>.</br> If you are interested in buying a decryptor, contact me: [email protected]</p> As a proof of my capabilities, I will decrypt 1 file. The test file should not have value.</p> Do not try to cheat, otherwise the price will double.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>No one in the world can decrypt your data except me. Please do not forget to make a copy before trying to decrypt yourself, otherwise I can not help you</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> <li>If you have not received a response within 24 hours, please contact us: [email protected]</li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html> �

Emails

[email protected]</p>

[email protected]

[email protected]</li>

Targets

- Target
  
  2025-04-03_4ca5c62cc636a403bab9fec77529ba89_globeimposter
- Size
  
  53KB
- MD5
  
  4ca5c62cc636a403bab9fec77529ba89
- SHA1
  
  59cf62d60a1becdb0d7d8fd405776494a447a25d
- SHA256
  
  7c77c34d63bb5912a2e6a2d3081158b244a42fe05b8366a127aa85568fb33825
- SHA512
  
  4ae127f264ecca59707c72df92445df499eeccc545e992cabba988885b1ce09d44f7d8b97960b774161aecc7565e7556ca5f88d49f4ed9d998792b0928664db4
- SSDEEP
  
  768:3Qvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5xxKtE:3qeytM3alnawrRIwxVSHMweio3x
Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Renames multiple (9079) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1