General
-
Target
2025-06-04_cee7d769e512f7adbe11c12625e05a98_elex_gcleaner_globeimposter
-
Size
53KB
-
Sample
250604-1kynqswwav
-
MD5
cee7d769e512f7adbe11c12625e05a98
-
SHA1
8e086faa95d88c11a9e8a03e21a50a0ff332c6a3
-
SHA256
1da5361ab124d8ab69ac1d8fee744cedd9a1907199c743b91f230b1220db0116
-
SHA512
24ccd7aadf97abf1e61d2782bea190595b4829a3936398569f2444bd6edf233deeabc89592ea562cb73558248a672a2bba23a27a7ecde16eb55552a4ef9f6b7e
-
SSDEEP
768:lTHDIvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vF:MeytM3alnawrRIwxVSHMweio3ZF
Static task
static1
Behavioral task
behavioral1
Sample
2025-06-04_cee7d769e512f7adbe11c12625e05a98_elex_gcleaner_globeimposter.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-06-04_cee7d769e512f7adbe11c12625e05a98_elex_gcleaner_globeimposter.exe
Resource
win11-20250502-en
Malware Config
Extracted
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\HOW_TO_BACK_FILES.html
Extracted
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\HOW_TO_BACK_FILES.html
Targets
-
-
Target
2025-06-04_cee7d769e512f7adbe11c12625e05a98_elex_gcleaner_globeimposter
-
Size
53KB
-
MD5
cee7d769e512f7adbe11c12625e05a98
-
SHA1
8e086faa95d88c11a9e8a03e21a50a0ff332c6a3
-
SHA256
1da5361ab124d8ab69ac1d8fee744cedd9a1907199c743b91f230b1220db0116
-
SHA512
24ccd7aadf97abf1e61d2782bea190595b4829a3936398569f2444bd6edf233deeabc89592ea562cb73558248a672a2bba23a27a7ecde16eb55552a4ef9f6b7e
-
SSDEEP
768:lTHDIvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5vF:MeytM3alnawrRIwxVSHMweio3ZF
-
Globeimposter family
-
Renames multiple (6153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1