globeimposter

General

Target

2025-04-06_77cefe5134b67337726572338eefddc9_globeimposter
Size

55KB
Sample

250406-f8jjhaswcw
MD5

77cefe5134b67337726572338eefddc9
SHA1

cde1172c91de4a07d190ff5c66d700b5606ff957
SHA256

301069811422de2664fa07d3e855f8438de3eefb26cdc69ba02eae37f29e1d9c
SHA512

f86e570bc658e641b2deb055df1d7ba9846860006af70201981db2e5d7ba2c08b3635ebdb807f5c322a788d8b4b79d6eaac40240c2d962dbd155302a0ef25772
SSDEEP

1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx4:bOePKs+Na3IrKJolntGDT5XtC4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text">  <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>��21 75 54 8A 13 20 49 D6 B0 66 83 13 3B EC E6 77 C7 6F EC 5F 8A 96 0E AC 98 80 54 3C F2 07 A3 EA E6 86 1E B4 CE 20 6C FD 83 ED 75 BB CB DE 2F AC 42 C8 33 56 76 B4 21 D0 79 8C 2E 60 8D 76 75 76 A9 5F DA 24 F3 0C EF D6 02 09 57 2E CF 7B 18 D1 FD 88 F3 A9 02 79 4B A6 AD 23 A5 1F C0 41 3E 47 A5 E5 D5 80 A3 83 0F 3F 18 6D 01 DD 96 6E 99 FB 44 10 36 6C 93 26 D4 9F 77 EC 59 BA 14 80 CF C2 B2 D2 F0 7A AB 2A 39 E3 63 9E 6B DD 60 BA D5 2F 47 D1 27 3E 9C A3 B5 77 BD 6C 81 D4 9F 0C 31 3B 94 EC E1 E2 83 B2 91 6C B5 F2 E5 7E 72 7A 28 0C 6A 38 67 56 7B 78 85 3B 8C 6A F4 78 7E 57 EA 5F 95 77 49 F9 6F 57 46 1B 36 5E A3 B7 94 00 6F 08 64 A0 D7 F0 1C 4F A0 76 F8 0B 16 70 7F C2 00 0F B2 68 B9 38 77 0C 20 3A 39 3A 1A F4 6C 08 63 52 65 A8 06 23 15 81 00 3E 74 0D 6A 4A 55 98 9E 3F </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul>  </div> </div> </div> </body> </html>��

Emails

[email protected]

Targets

- Target
  
  2025-04-06_77cefe5134b67337726572338eefddc9_globeimposter
- Size
  
  55KB
- MD5
  
  77cefe5134b67337726572338eefddc9
- SHA1
  
  cde1172c91de4a07d190ff5c66d700b5606ff957
- SHA256
  
  301069811422de2664fa07d3e855f8438de3eefb26cdc69ba02eae37f29e1d9c
- SHA512
  
  f86e570bc658e641b2deb055df1d7ba9846860006af70201981db2e5d7ba2c08b3635ebdb807f5c322a788d8b4b79d6eaac40240c2d962dbd155302a0ef25772
- SSDEEP
  
  1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx4:bOePKs+Na3IrKJolntGDT5XtC4
Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Renames multiple (9067) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1