Globe3 Ransomware

Posted: January 9, 2017
Threat Metric
Threat Level: 10/10
Infected PCs 116,049

Globe3 Ransomware Description

The Globe3 Ransomware is an updated version of the Globe Ransomware, a Trojan that encrypts your files to block you from opening them, allowing it to extort ransoms. Although the Globe3 Ransomware uses an upgraded algorithm for its encryption feature, the majority of its symptoms are consistent with past versions of this Trojan family, including pop-up ransom messages and changes to filename extensions. Because free decryption solutions are not always possible, you always should try to remove the Globe3 Ransomware with anti-malware protection preemptively.

Staying Competitive in the Trojan Rat Race

Although their victims tend to see only their end of the situation, a Trojan's design often owes just as much to the underground marketplace environs as it does to the intended impact on the infected PC. The Globe Ransomware's authors recently upgraded their family to a new release, the Globe3 Ransomware, which conducts all of the previously-noted attacks but also uses a more marketplace-standardized form of encryption.

The Globe3 Ransomware still uses the for-rent to third party con artists model of business, causing its possible distribution methods to vary wildly. Regardless of which threat actors deploy it, the Globe3 Ransomware always scans for local files (including network shares and any plugged-in external drives) and encrypts file formats, such as TXT, XLS and DOC. It uses the AES-256, a significant upgrade from the previous Blowfish that is nearly unique to the Globe Ransomware family. Different variants of the Globe3 Ransomware also append various text strings to their names, such as a '.decrypt2017' extension.

After blocking your local content and deleting any SVC-based backups, the Globe3 Ransomware creates the same HTA-based ransoming message that malware experts find in past versions of the Trojan. The instructions ask for Bitcoin payments to a wallet address, with the extortionist promising to restore your files by decrypting them afterward.

Three Time's the Charm for Cyber Security

Although its infection vectors are potentially unpredictable, most threat actors are likely of distributing the Globe3 Ransomware using previously-verified tactics, such as:

  • Spam e-mail may disguise the Globe3 Ransomware's installer as a PDF or Word document related to your work or local deliveries. Most anti-malware programs should detect these Trojan droppers heuristically.
  • Some businesses also may be hacked directly by con artists brute-forcing their account security. Strong passwords are essential to preventing these attacks.
  • In rarer occasions, con artists may infect random traffic through exploit kits embedded on compromised sites. Taking basic security steps, such as disabling JavaScript when you don't need it, can alleviate most Web-surfing security loopholes.

The anti-malware company Emsisoft is maintaining download links for their free version of the Globe3 Ransomware decryptor. Most victims should try using these decryptors, whenever backups are not available. For those who do have backups, deleting the Globe3 Ransomware with anti-malware products and then restoring their files from their latest copies should resolve all damages.

The con artists aren't just competing with anti-malware solutions, but with each other, in the global marketplace for threats. PC users who don't protect themselves or back their data up may need to exercise patience until new decryption solutions can be developed for updates to old Trojans, just like the Globe3 Ransomware.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Globe3 Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%SystemDrive%\Users\Java18\AppData\Local\Read Me Please.hta File name: Read Me Please.hta
Size: 5.5 KB (5505 bytes)
MD5: f4c0a7e3ba039b909b54c4bde39063b3
Detection count: 115
Mime Type: unknown/hta
Path: %SystemDrive%\Users\Java18\AppData\Local\
Group: Malware file
Last Updated: April 28, 2017
%LOCALAPPDATA%HOW_OPEN_FILES.hta File name: HOW_OPEN_FILES.hta
Size: 4.56 KB (4569 bytes)
MD5: e35a5d8aaabaaed5fd6153cf8ead36e6
Detection count: 112
Mime Type: unknown/hta
Path: %LOCALAPPDATA%
Group: Malware file
Last Updated: January 27, 2017
%LOCALAPPDATA%trust.exe File name: trust.exe
Size: 64.51 KB (64512 bytes)
MD5: 668c83c1f7f13259ab5d1699ea24d17f
Detection count: 46
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%
Group: Malware file
Last Updated: September 1, 2016
%ALLUSERSPROFILE%How To Recover Encrypted Files.hta File name: How To Recover Encrypted Files.hta
Size: 4.53 KB (4531 bytes)
MD5: f6c1ab1ad892c5e2d48475b2f5dbec9c
Detection count: 23
Mime Type: unknown/hta
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: April 15, 2017
file.exe File name: file.exe
Size: 28.95 KB (28952 bytes)
MD5: a464f7bc0431292d74ad66403efbf691
Detection count: 15
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications


The following newly produced Registry Values are:

File name without pathHow To Recover Encrypted Files.htaHow To Recover Encrypted Files.htmlHow to restore files.htaHOW_OPEN_FILES.htaRead Me Please.htaRegistry keySoftware\Microsoft\Windows\CurrentVersion\Run\How To Recover Encrypted Files
Home Malware Programs Ransomware Globe3 Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.