globeimposter | b471746c5de0006a897166852601ab8169092ec1f269b76934f4443bcd5fc401 | Triage

Sharing

General

Target

2025-04-06_9da88ef1315682f537b5c97875d98c9c_globeimposter
Size

52KB
Sample

250406-jycvratzat
MD5

9da88ef1315682f537b5c97875d98c9c
SHA1

feb46be21c90c7ff7257faf13e7594d0973fa470
SHA256

b471746c5de0006a897166852601ab8169092ec1f269b76934f4443bcd5fc401
SHA512

53454a8de1ada84f00c7b94aa72e57b2b318408f160fb7a05e83c6fbd8e5363dce6fa40741ee9c8a5101f6f4007d2dd61a40a8e17544c8217a0708379697ad38
SSDEEP

1536:1heytM3alnawrRIwxVSHMweio3xAeCrg:1hey23alnaEIN/WPC

Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  2025-04-06_9da88ef1315682f537b5c97875d98c9c_globeimposter
- Size
  
  52KB
- MD5
  
  9da88ef1315682f537b5c97875d98c9c
- SHA1
  
  feb46be21c90c7ff7257faf13e7594d0973fa470
- SHA256
  
  b471746c5de0006a897166852601ab8169092ec1f269b76934f4443bcd5fc401
- SHA512
  
  53454a8de1ada84f00c7b94aa72e57b2b318408f160fb7a05e83c6fbd8e5363dce6fa40741ee9c8a5101f6f4007d2dd61a40a8e17544c8217a0708379697ad38
- SSDEEP
  
  1536:1heytM3alnawrRIwxVSHMweio3xAeCrg:1hey23alnaEIN/WPC
Score

10^/10

globeimposter defense_evasion discovery persistence ransomware spyware stealer
- GlobeImposter
  GlobeImposter is a ransomware first seen in 2017.
  ransomware globeimposter
- Globeimposter family
  globeimposter
- Renames multiple (9123) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer