MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GlobeImposter


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d
SHA3-384 hash: 545b83ed9b35b9f32049ec140255a7896a54eb2d915fde39b4774129b78fd6a8b6e8de76f32483785cd0ddc37759a1af
SHA1 hash: 7aef263a300c999b2a3d7d459308db6fb1906790
MD5 hash: 82f5dbbe1726bb9005072690b201aaac
humanhash: undress-hawaii-north-johnny
File name:70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d.bin
Download: download sample
Signature GlobeImposter
Create hunting rule
File size:52'224 bytes
First seen:2021-12-23 21:58:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba2ce247fa49357770ce28f139e2f1ab (17 x GlobeImposter)
ssdeep 768:CJvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5mXw:ieytM3alnawrRIwxVSHMweio3MXw
Threatray 8 similar samples on MalwareBazaar
TLSH T1DF336C83B98346F1F7E3117D5A2B370EA695FB2C0069DA6BC7940C47CE3024362396E5
Reporter Arkbird_SOLG
Tags:exe GlobeImposter Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
911
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d.bin
Verdict:
Malicious activity
Analysis date:
2021-12-23 22:00:58 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/f45a7768-c549-4498-9fa2-ffeec51b85cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/216028/
Detection(s):
Win.Ransomware.Globeimposter-6991673-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Changing a file
Moving a recently created file
Modifying an executable file
Reading critical registry keys
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
DNS request
Setting a single autorun event
Creating a file in the mass storage device
Stealing user critical data
Encrypting user's files
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3044/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
cryptolocker filecoder globeimposter ransomware
Link:
https://www.filescan.io/uploads/61c4f1298991ba72b394545a/reports/aef1b1e8-889f-4753-92d0-c30f9cdc42e6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Globeimposter
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b4b5e85f-51fb-45a2-aef6-133840ed4363
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/912202
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
globeimposter
Create hunting rule
Link:
https://mwdb.cert.pl/sample/70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d/
Threat name:
Win32.Ransomware.FileCoder
Create hunting rule
Status:
Malicious
First seen:
2021-12-23 21:59:10 UTC
File Type:
PE (Exe)
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=od5a5fykbqu5uz5v6fditfxoz5yrmjlmfnzbf63gm6ypxevnqooq._file
Verdict:
malicious
Similar samples:
15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704
GlobeImposter
21766e51afd193a59b8b32f38d7f852022ee58348537be2fa7620773df237f77
GlobeImposter
37ff5b1492fe4e1083bdc87df3524d4ac7b5b604e71dfca3730a6527d3bb7d2a
GlobeImposter
60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12
GlobeImposter
9add64c3f617392ec57bb083513237bdb50113bf908883aaa40894d6499ba8db
GlobeImposter
d03c843490124f40cf12e9cf9ceb3435d564b4b58ad6eecc04046476dc27d29a
GlobeImposter
daa69519885c0f9f4947c4e6f82a0375656630e0abf55a345a536361f986252e
GlobeImposter
Result
Malware family:
globeimposter
Create hunting rule
Score:
  10/10
Tags:
family:globeimposter persistence ransomware spyware stealer
Link:
https://tria.ge/reports/211223-1v3enscdhr/
Behaviour
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Modifies extensions of user files
GlobeImposter
Unpacked files
SH256 hash:
4ebb5de6cdf7be3b0eca31f7377b8196e35884e527908830d231ab3bad4f5651
MD5 hash:
b9dd7d90f7c79822809b088c8f0b3a2d
SHA1 hash:
9e08200b34f84681281094a513512b4b1b23c9c4
Link:
https://www.unpac.me/results/175f1b8f-87fb-40ea-9325-3850395c4f8a/
SH256 hash:
70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d
MD5 hash:
82f5dbbe1726bb9005072690b201aaac
SHA1 hash:
7aef263a300c999b2a3d7d459308db6fb1906790
Detections:
win_globeimposter_auto
Create hunting rule
Link:
https://www.unpac.me/results/175f1b8f-87fb-40ea-9325-3850395c4f8a/
Parent samples :
21766e51afd193a59b8b32f38d7f852022ee58348537be2fa7620773df237f77
70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/70fa0e970a0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.86
Link:
https://yomi.yoroi.company/submissions/70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_globeimposter_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.globeimposter.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GlobeImposter

Executable exe 21766e51afd193a59b8b32f38d7f852022ee58348537be2fa7620773df237f77

GlobeImposter

Executable exe 70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d

(this sample)

  
Dropped by
SHA256 21766e51afd193a59b8b32f38d7f852022ee58348537be2fa7620773df237f77
  
URLhaus
https://urlhaus.abuse.ch/url/1709504/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/216028/

Comments