globeimposter

General

Target

2025-04-06_77cefe5134b67337726572338eefddc9_globeimposter
Size

55KB
Sample

250406-ga7n4svny7
MD5

77cefe5134b67337726572338eefddc9
SHA1

cde1172c91de4a07d190ff5c66d700b5606ff957
SHA256

301069811422de2664fa07d3e855f8438de3eefb26cdc69ba02eae37f29e1d9c
SHA512

f86e570bc658e641b2deb055df1d7ba9846860006af70201981db2e5d7ba2c08b3635ebdb807f5c322a788d8b4b79d6eaac40240c2d962dbd155302a0ef25772
SSDEEP

1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx4:bOePKs+Na3IrKJolntGDT5XtC4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text">  <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> nakanishi@india.com </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>��4A FF 67 68 1D 4C D1 A5 CC 45 99 EF E2 55 85 AE 1D AD 9A C2 94 47 8A 35 96 4D E6 E4 0A 43 1C 86 5B B3 95 58 19 B8 32 71 7D C2 1C 14 B4 64 43 E9 06 4B DC 07 C6 C8 8E 6E A1 49 D7 F2 6D 28 A5 5C 1C 4D 3D C2 3A CF F3 07 05 A5 89 75 2F 28 DF 41 E6 16 C9 75 A6 3A 4F 81 EA 2F CE 0A 5B 51 2A 6C DE 9B C7 14 9C E7 90 B3 45 DC 43 CA D9 65 5D 4B A5 F3 9D 1D B1 26 F8 66 D4 5A DF AB 05 91 AF 30 42 AB 69 01 08 34 BD F1 10 8C E7 68 71 2F 59 54 DF F9 85 A6 7A 00 EE 30 1E 7F 99 FC 59 EE C9 64 39 32 F6 60 69 74 C1 DC 93 05 58 98 F3 80 40 03 BE 0A 13 07 6E B8 3E E1 23 53 58 DB 80 CD 01 12 55 67 EA 32 E5 E0 3E 30 12 8F 56 71 AB 16 82 47 76 8D C7 6B 85 4A AF 1D F3 8B 03 79 B5 1B 05 94 6C 33 69 14 24 41 2D EB 7E E4 4B 9F 9F EC 0E 6C 74 F3 93 0C 8A 63 36 DD CD F8 84 B7 95 A3 0C C1 </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> nakanishi18@tutanota.com </strong></li></ul>  </div> </div> </div> </body> </html>��

Emails

nakanishi@india.com

nakanishi18@tutanota.com

Targets

- Target
  
  2025-04-06_77cefe5134b67337726572338eefddc9_globeimposter
- Size
  
  55KB
- MD5
  
  77cefe5134b67337726572338eefddc9
- SHA1
  
  cde1172c91de4a07d190ff5c66d700b5606ff957
- SHA256
  
  301069811422de2664fa07d3e855f8438de3eefb26cdc69ba02eae37f29e1d9c
- SHA512
  
  f86e570bc658e641b2deb055df1d7ba9846860006af70201981db2e5d7ba2c08b3635ebdb807f5c322a788d8b4b79d6eaac40240c2d962dbd155302a0ef25772
- SSDEEP
  
  1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx4:bOePKs+Na3IrKJolntGDT5XtC4
Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Renames multiple (9120) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1