Overview

overview

10

Static

static

3

sub_d16518abb5dc.exe

windows10-2004-x64

10

sub_d16518abb5dc.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    sub_d16518abb5dc.bin
  • Size 55KB
  • Sample260524-cghw4sav71
  • SHA256 d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��37 7B FC 6E 9A 4E FD CA 99 4D B7 04 65 87 C7 87 13 E3 EA 2C B1 9B ED 81 AE 1E 59 51 E0 CF 8D FB DC F5 A3 41 CD E7 E2 9C 3C 3D EF 4D 8F E8 58 E7 E6 DA B9 CF C8 E7 8B CF 39 97 CA B2 EB 83 D7 F7 0B 9A C7 4B B6 6E B8 11 A7 F6 3F A4 21 99 FC 0C 11 A7 CA BB 5E 32 BB 93 68 41 09 63 59 C0 73 C4 6B 42 0A 59 BC E0 1B 97 EE 77 A3 BB 3C B0 7E DD F0 2E B9 95 E5 6C C0 43 77 07 C1 B6 F9 47 3C FF AD BE 7D 24 C4 59 DF C9 9A 74 13 17 A5 D9 FB EA 03 DD B6 48 4E BD 5E A7 97 9E BC 35 6F E6 A4 4A 98 3D 97 36 76 4A 20 C4 8A 7A 18 D0 E0 95 C7 A4 BC B6 A6 3B CF FD ED 03 6A 5A AE DB 7B 89 F4 0D 8F F6 AF 60 68 A9 0C C4 D2 FE F9 C2 1E 95 A5 5E CC 3B E7 5A 7E F3 2A DA 88 C4 F3 3A 1A 17 95 52 20 6C C1 F9 95 D0 8B D3 4D 97 11 DE 99 2B DC BE 72 0A 47 9E C0 A4 30 AC 12 7D A4 A1 C1 52 F3 16 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

  • C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��50 71 77 CC 6B 55 66 27 40 26 A0 67 82 06 D2 F5 F9 DF E6 3A 53 27 C4 79 C8 DC 9C EF 36 EB FF 49 C6 AD B9 DA 7E 4F AE CC 8F 48 36 02 DA D2 3E B0 5F 38 88 F8 5E E5 40 4E ED 80 68 72 B1 27 7D 1B 41 C1 DC 41 36 08 2F 53 0F C3 79 6B 54 50 C5 F7 B6 B9 87 B7 C6 0F 3B 69 2A 76 FB 45 66 DE 67 C0 99 AF 77 58 29 A4 C7 01 34 D0 E2 6C 98 7A 8B AF 8D 7A 30 70 7C 05 E3 4E 11 6C 12 19 1A 30 6C 62 3D B2 AD 57 E6 A7 41 90 9E 5A D7 E7 70 79 98 F0 71 CA F6 53 5C 26 F9 B0 23 B3 CF F9 5C B8 89 EA 8E EB E9 80 4F 0A 28 F1 24 18 77 93 FC C0 5D E7 58 4C A5 FA 16 B4 07 44 53 1D 36 FD 92 F9 DF DC 4C D2 C2 19 10 4E 6D 6E 44 FD 25 6C AC C4 72 99 76 F5 00 40 A9 84 00 21 B5 4C 57 63 79 F6 03 08 0A 23 FD D2 FF 96 19 1C 6C 42 79 B5 55 36 CE BC C6 EC E7 F7 76 3B AB DA A9 EE 1B A4 86 10 34 10 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target
      sub_d16518abb5dc.bin
    • Size 55KB
    • SHA256 d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryglobeimposterpersistenceransomwarespywarestealer

    • Family: GlobeImposter

      GlobeImposter is a ransomware first seen in 2017.

      ransomwareglobeimposter

    • Renames multiple (9210) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks