Overview

overview

10

Static

static

3

2025-04-05...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-05_91188a1bdb224e084c7753f51e8b6642_globeimposter

  • Size

    53KB

  • Sample

    250405-1e7dpayky9

  • MD5

    91188a1bdb224e084c7753f51e8b6642

  • SHA1

    bdd26cc5655b71214bea04062cfabc66326e85bf

  • SHA256

    141b6a1699899d9f0f2457574d1b9453fd126b162ada852065549d81bc362f3d

  • SHA512

    e76d80be546166f2d2c43bcf7a497cdc2505105646b0ae4a625b65ad04a8c11a1ce3ad52844c870d585f1e81ffc5ebe9f80e0c64ae418e6b5fa1bd1f98005432

  • SSDEEP

    1536:gGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiodbf:5SPKs+Na3IrKJolntGDT5XtdD

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
<html> <head> <meta charset="utf-8"> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Attention! All your files are encrypted.</div> <div class="note alert"> <ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software - "YASUDA DECRYPTOR" Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li> <li>If you want to restore files, write us to the e-mail: [email protected] In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li> <li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> </ul> </div> <div class="note private"> <div class="title">Your personal ID</div> <pre>���������������83 30 71 28 AF D7 C5 B7 CB F4 23 6C 27 6A 8F 71 06 30 39 DC B5 79 93 82 34 85 E7 2D FE 67 12 01 49 79 3F B5 4B B2 6E 1C C3 89 AF BE 23 6A 5E 53 A6 C3 FB 6B 0B 94 8A 12 50 10 C5 F5 E4 D0 C0 94 2A 2D 9F 92 CE AD 12 55 8F 46 FE 29 D7 29 3F EA CD 15 90 55 9E 55 E8 7F CF 54 8F 0B F9 28 C4 58 CD EF 25 98 D3 18 A0 DA F2 17 20 46 58 B2 7E 28 E1 35 AC 35 43 00 AB 0D 68 AC 71 CA 52 7F F7 63 4D 3D 07 EF 24 4D 05 98 05 AB D1 C8 2E 4E 7E 0A 3D 9B 74 25 02 F8 4E 12 9B 8F 53 A1 85 67 E7 DE E7 AA 51 4C 64 B8 8B E5 11 FA 0C B3 E9 EC B2 38 94 EA 63 BF BB C1 5A 78 EF 5C AC F3 25 AA CF E6 07 95 A1 70 AD 00 CF BB F8 F4 29 0E 3F 09 AE 83 45 D9 C3 23 40 7C 13 C0 BA 18 10 C8 16 24 FD F4 CE E2 ED 3A 44 74 6D 8F 78 3B 87 3B C9 36 CD 83 19 66 31 D9 B0 33 86 9F 46 84 48 08 A3 0F 65 C6 </pre> </div> </body> </html>��������

Targets

    • Target

      2025-04-05_91188a1bdb224e084c7753f51e8b6642_globeimposter

    • Size

      53KB

    • MD5

      91188a1bdb224e084c7753f51e8b6642

    • SHA1

      bdd26cc5655b71214bea04062cfabc66326e85bf

    • SHA256

      141b6a1699899d9f0f2457574d1b9453fd126b162ada852065549d81bc362f3d

    • SHA512

      e76d80be546166f2d2c43bcf7a497cdc2505105646b0ae4a625b65ad04a8c11a1ce3ad52844c870d585f1e81ffc5ebe9f80e0c64ae418e6b5fa1bd1f98005432

    • SSDEEP

      1536:gGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiodbf:5SPKs+Na3IrKJolntGDT5XtdD

    Score
    10/10
    globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

    • GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Globeimposter family

      globeimposter

    • Renames multiple (9095) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks