SYMBOLCOMMON_NAMEaka. SYNONYMS
win.globeimposter (Back to overview)

GlobeImposter

URLhaus      

There is no description at this point.

References
2020-06-22CERT-FRCERT-FR
@techreport{certfr:20200622:volution:fba1cfa, author = {CERT-FR}, title = {{Évolution De Lactivité du Groupe Cybercriminel TA505}}, date = {2020-06-22}, institution = {CERT-FR}, url = {https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf}, language = {French}, urldate = {2020-06-24} } Évolution De Lactivité du Groupe Cybercriminel TA505
Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot
2020-05-21Intel 471Intel 471
@online{471:20200521:brief:048d164, author = {Intel 471}, title = {{A brief history of TA505}}, date = {2020-05-21}, organization = {Intel 471}, url = {https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/}, language = {English}, urldate = {2020-05-23} } A brief history of TA505
AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-02-25RSA ConferenceJoel DeCapua
@online{decapua:20200225:feds:423f929, author = {Joel DeCapua}, title = {{Feds Fighting Ransomware: How the FBI Investigates and How You Can Help}}, date = {2020-02-25}, organization = {RSA Conference}, url = {https://www.youtube.com/watch?v=LUxOcpIRxmg}, language = {English}, urldate = {2020-03-04} } Feds Fighting Ransomware: How the FBI Investigates and How You Can Help
FastCash Cerber Defray Dharma FriedEx Gandcrab GlobeImposter Mamba Phobos Ransomware Rapid Ransom REvil Ryuk SamSam Zeus
2020-01-17SecureworksTamada Kiyotaka, Keita Yamazaki, You Nakatsuru
@techreport{kiyotaka:20200117:is:969ff38, author = {Tamada Kiyotaka and Keita Yamazaki and You Nakatsuru}, title = {{Is It Wrong to Try to Find APT Techniques in Ransomware Attack?}}, date = {2020-01-17}, institution = {Secureworks}, url = {https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf}, language = {English}, urldate = {2020-04-06} } Is It Wrong to Try to Find APT Techniques in Ransomware Attack?
Defray Dharma FriedEx Gandcrab GlobeImposter Matrix Ransom MedusaLocker Phobos Ransomware REvil Ryuk SamSam Scarab Ransomware
2020SecureworksSecureWorks
@online{secureworks:2020:gold:65fcc96, author = {SecureWorks}, title = {{GOLD SWATHMORE}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/gold-swathmore}, language = {English}, urldate = {2020-05-23} } GOLD SWATHMORE
GlobeImposter Gozi IcedID TrickBot Lunar Spider
2018-03-07InfoSec Handlers Diary BlogBrad Duncan
@online{duncan:20180307:ransomware:504a693, author = {Brad Duncan}, title = {{Ransomware news: GlobeImposter gets a facelift, GandCrab is still out there}}, date = {2018-03-07}, organization = {InfoSec Handlers Diary Blog}, url = {https://isc.sans.edu/diary/23417}, language = {English}, urldate = {2020-01-06} } Ransomware news: GlobeImposter gets a facelift, GandCrab is still out there
Gandcrab GlobeImposter
2018-01-16enSiloAlon Hadar
@online{hadar:20180116:globeimposter:6a2afda, author = {Alon Hadar}, title = {{GlobeImposter Ransomware}}, date = {2018-01-16}, organization = {enSilo}, url = {https://blog.ensilo.com/globeimposter-ransomware-technical}, language = {English}, urldate = {2019-07-09} } GlobeImposter Ransomware
GlobeImposter
2018-01-15AcronisAcronis Security
@online{security:20180115:globeimposter:b5ca4e4, author = {Acronis Security}, title = {{GlobeImposter ransomware: A holiday gift from the Necurs botnet}}, date = {2018-01-15}, organization = {Acronis}, url = {https://www.acronis.com/en-us/blog/posts/globeimposter-ransomware-holiday-gift-necurs-botnet}, language = {English}, urldate = {2020-01-13} } GlobeImposter ransomware: A holiday gift from the Necurs botnet
GlobeImposter
2017-12-22Bleeping ComputerLawrence Abrams
@online{abrams:20171222:new:eadbe96, author = {Lawrence Abrams}, title = {{New .DOC GlobeImposter Ransomware Variant Malspam Campaign Underway}}, date = {2017-12-22}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/new-doc-globeimposter-ransomware-variant-malspam-campaign-underway/}, language = {English}, urldate = {2019-12-20} } New .DOC GlobeImposter Ransomware Variant Malspam Campaign Underway
GlobeImposter
2017-08-10PhishLabsAmanda Kline
@online{kline:20170810:globe:382859f, author = {Amanda Kline}, title = {{Globe Imposter Ransomware Makes a New Run}}, date = {2017-08-10}, organization = {PhishLabs}, url = {https://info.phishlabs.com/blog/globe-imposter-ransomware-makes-a-new-run}, language = {English}, urldate = {2020-01-07} } Globe Imposter Ransomware Makes a New Run
GlobeImposter
2017-08-05FortinetXiaopeng Zhang
@online{zhang:20170805:analysis:8c21b07, author = {Xiaopeng Zhang}, title = {{Analysis of New GlobeImposter Ransomware Variant}}, date = {2017-08-05}, organization = {Fortinet}, url = {https://blog.fortinet.com/2017/08/05/analysis-of-new-globeimposter-ransomware-variant}, language = {English}, urldate = {2019-11-22} } Analysis of New GlobeImposter Ransomware Variant
GlobeImposter
Yara Rules
[TLP:WHITE] win_globeimposter_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_globeimposter_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f6e6614 0ff4e0 0fd4cb 0f6e7618 0ff4f0 0f7e4f04 0f73d120 }
            // n = 7, score = 700
            //   0f6e6614             | movd                mm4, dword ptr [esi + 0x14]
            //   0ff4e0               | pmuludq             mm4, mm0
            //   0fd4cb               | paddq               mm1, mm3
            //   0f6e7618             | movd                mm6, dword ptr [esi + 0x18]
            //   0ff4f0               | pmuludq             mm6, mm0
            //   0f7e4f04             | movd                dword ptr [edi + 4], mm1
            //   0f73d120             | psrlq               mm1, 0x20

        $sequence_1 = { 8b4508 8b4e08 89442418 85ff 7452 }
            // n = 5, score = 700
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b4e08               | mov                 ecx, dword ptr [esi + 8]
            //   89442418             | mov                 dword ptr [esp + 0x18], eax
            //   85ff                 | test                edi, edi
            //   7452                 | je                  0x54

        $sequence_2 = { 45 83c104 f7db 75d7 }
            // n = 4, score = 700
            //   45                   | inc                 ebp
            //   83c104               | add                 ecx, 4
            //   f7db                 | neg                 ebx
            //   75d7                 | jne                 0xffffffd9

        $sequence_3 = { c1e810 0bf8 8bc7 f7f6 33d2 0fafc6 2bf8 }
            // n = 7, score = 700
            //   c1e810               | shr                 eax, 0x10
            //   0bf8                 | or                  edi, eax
            //   8bc7                 | mov                 eax, edi
            //   f7f6                 | div                 esi
            //   33d2                 | xor                 edx, edx
            //   0fafc6               | imul                eax, esi
            //   2bf8                 | sub                 edi, eax

        $sequence_4 = { 8bf0 85f6 7574 8d4738 }
            // n = 4, score = 700
            //   8bf0                 | mov                 esi, eax
            //   85f6                 | test                esi, esi
            //   7574                 | jne                 0x76
            //   8d4738               | lea                 eax, [edi + 0x38]

        $sequence_5 = { 7413 8b4508 8d04b8 83c0fc 3918 7506 83e804 }
            // n = 7, score = 700
            //   7413                 | je                  0x15
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d04b8               | lea                 eax, [eax + edi*4]
            //   83c0fc               | add                 eax, -4
            //   3918                 | cmp                 dword ptr [eax], ebx
            //   7506                 | jne                 8
            //   83e804               | sub                 eax, 4

        $sequence_6 = { 8bd0 85d2 7514 8b4608 }
            // n = 4, score = 700
            //   8bd0                 | mov                 edx, eax
            //   85d2                 | test                edx, edx
            //   7514                 | jne                 0x16
            //   8b4608               | mov                 eax, dword ptr [esi + 8]

        $sequence_7 = { eb0d 3d96000000 1bff 83e709 }
            // n = 4, score = 700
            //   eb0d                 | jmp                 0xf
            //   3d96000000           | cmp                 eax, 0x96
            //   1bff                 | sbb                 edi, edi
            //   83e709               | and                 edi, 9

        $sequence_8 = { 0f73d120 0f6e6614 0ff4e0 0fd4cb 0f6e7618 0ff4f0 }
            // n = 6, score = 700
            //   0f73d120             | psrlq               mm1, 0x20
            //   0f6e6614             | movd                mm4, dword ptr [esi + 0x14]
            //   0ff4e0               | pmuludq             mm4, mm0
            //   0fd4cb               | paddq               mm1, mm3
            //   0f6e7618             | movd                mm6, dword ptr [esi + 0x18]
            //   0ff4f0               | pmuludq             mm6, mm0

        $sequence_9 = { 3b01 8d4914 1bc0 f7d0 }
            // n = 4, score = 700
            //   3b01                 | cmp                 eax, dword ptr [ecx]
            //   8d4914               | lea                 ecx, [ecx + 0x14]
            //   1bc0                 | sbb                 eax, eax
            //   f7d0                 | not                 eax

    condition:
        7 of them and filesize < 327680
}
Download all Yara Rules