globeimposter

General

Target

2025-04-06_415d7db59df39eca7550774348577051_globeimposter
Size

55KB
Sample

250406-aynsks1mt7
MD5

415d7db59df39eca7550774348577051
SHA1

0d6d2305d510e6717e6a986356e56a92caa8aae2
SHA256

840b35dac7996c32beda8526ca5618a134de6a0ae4dc64b061ecbc3c500adad1
SHA512

206d29333e9de6af7cc093bbb515048ff2abb2947c7b012cc6801b7e6dd6eb29f52f3f9e2e90f1a3c6d16b920aac22ec2fc992b2baaaddb311333f059bfcdc5a
SSDEEP

1536:LPKs+Na3IGeKJolntwr7DSTWvTwhQ8Yi6DNJ:LPKs+Na3IrKJolntGDT5X/BJ

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��98 0B F2 1E 87 0E B9 FA 82 A2 12 DF 36 7C B5 EE 68 75 C1 CB B7 64 F1 95 71 6B AD C7 A0 32 37 CC 9C 10 09 C5 9F 38 0A 97 5B 5C A6 B8 75 23 9C 01 89 FF 21 B8 00 51 59 7F 15 EB 2B CE 13 45 BC D8 95 99 11 64 14 B5 B6 43 E5 B7 06 B2 30 A4 E2 DC A0 75 68 B3 D6 E1 47 97 99 D7 C9 BB D0 32 E1 CE 10 21 61 A4 9F AC F2 9E C5 E6 7F 71 DF AE 02 A9 6E 71 67 0F 5A 11 EC DA A4 2A 5B 87 3E 88 06 D0 45 2F 5F 24 5D 00 5D B0 DB 3C 4B DF 4E A2 B5 3F DF 87 78 D5 E2 41 EF C6 92 72 7E 72 1F 27 61 1A 2A 0C 93 20 FE 86 F3 83 32 82 73 81 3C BB 31 24 23 74 16 BD 2D D7 5A 1B 4D 55 63 61 24 DD 58 88 B8 2C 29 76 38 18 FF 03 F2 30 36 31 B9 E9 CD 20 A0 D0 61 AE 59 B9 46 1F D7 75 C7 F1 26 CF 3E 8C F2 E2 3B B2 2F 71 AF 39 2D 9C D0 23 E3 11 27 FF AB DA 94 F4 C2 F6 7D 70 C7 03 2D 4B DB 53 63 BF </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☠ Your files are encrypted! ☠</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text">  To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span> [email protected]</span> or <span> [email protected]</span> .</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html> ��

Emails

[email protected]</span>

[email protected]

[email protected]</li>

Targets

- Target
  
  2025-04-06_415d7db59df39eca7550774348577051_globeimposter
- Size
  
  55KB
- MD5
  
  415d7db59df39eca7550774348577051
- SHA1
  
  0d6d2305d510e6717e6a986356e56a92caa8aae2
- SHA256
  
  840b35dac7996c32beda8526ca5618a134de6a0ae4dc64b061ecbc3c500adad1
- SHA512
  
  206d29333e9de6af7cc093bbb515048ff2abb2947c7b012cc6801b7e6dd6eb29f52f3f9e2e90f1a3c6d16b920aac22ec2fc992b2baaaddb311333f059bfcdc5a
- SSDEEP
  
  1536:LPKs+Na3IGeKJolntwr7DSTWvTwhQ8Yi6DNJ:LPKs+Na3IrKJolntGDT5X/BJ
Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Renames multiple (9196) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1