Globe Ransomware

Posted: August 24, 2016
Threat Metric
Threat Level: 10/10
Infected PCs 116,049

Globe Ransomware Description

The Globe Ransomware is a Trojan that uses the infected PC's files for enacting hostage-ransoming scenarios. Data is held hostage by an encryption attack that also may cause incidental damage to your installed programs or operating system. Taking any steps suitable for disabling the Trojan's attacks and using anti-malware programs to delete the Globe Ransomware automatically is the recovery strategy malware experts recommend, in contrast to the risk of paying its ransom.

The Other Dangers of a Blowfish Attack

In addition to being a toxic species of fish, security analysts also know of Blowfish as an alternative data ciphering algorithm. It maintains a high level of effectiveness against decryption efforts but is less common in usage than AES. The Globe Ransomware is one of the few samples of file-encrypting Trojans that malware experts can confirm as using Blowfish, which is unsuitable for large files notably (several gigabytes or more in size). However, the encryption technique's limitations do little to reduce the potential damages of a corrupted file-encrypting attack.

The Globe Ransomware uses English-based extortion communications but regionally appears to be targeting Central Asian nations, such as Afghanistan. Its payload includes two formats of ransom messages with slightly differing contents, one of which includes extra payment details, the other of which the Globe Ransomware locks to your desktop as its background. However, its primary attack and symptoms are related to encryption:

  • The Globe Ransomware uses the Blowfish cipher to modify the data of your files, encrypting them and stopping other programs from interpreting their contents correctly. Although Blowfish uses a much smaller block size compared to AES-256, it's equally viable for the practical purpose of preventing a PC's owner from accessing small documents, images, music and similar information. The attack may be re-initiated after the system restarts, causing increasingly more content to be attacked.
  • It also renames the enciphered content with the insertion of an e-mail address (as a means of ransom communications).
  • The Globe Ransomware also deletes local Windows backups (known as Shadow Copies) to deprive its victims of the most on-hand method of recovering any files.
  • Various Windows security and recovery features can become disabled, including Windows Startup Repair.

Smashing a the Globe of File-Encrypting Venom

The Globe Ransomware follows with many of the trends in file encryption Trojans today, including preferring Bitcoin ransoms, relying on e-mail messages heavily, and targeting narrow regions of the world. Although using Blowfish is a technically notable feature, this difference provides little hope of vulnerabilities that could help a victim recover encrypted content through free methods. PC owners that invested in their data always should take the proper steps for protecting it, including using backups out of the reach of Trojans like the Globe Ransomware.

When security software doesn't block it preemptively, the Globe Ransomware's symptoms are highly visible. Malware experts haven't confirmed evidence of its infection methods, which could include e-mail attachments, drive-by-downloads hosted in malvertising content, or 'brute force' attacks against poorly protected networks. All of these methods are blockable by standard security protocols that are less difficult than decrypting a Blowfish cipher significantly.

Between common security standards and having anti-malware equipment for removing the Globe Ransomware on sight, paying a con artist a fee to get your data back is the worst option available clearly.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Globe Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%SystemDrive%\Users\Java18\AppData\Local\Read Me Please.hta File name: Read Me Please.hta
Size: 5.5 KB (5505 bytes)
MD5: f4c0a7e3ba039b909b54c4bde39063b3
Detection count: 115
Mime Type: unknown/hta
Path: %SystemDrive%\Users\Java18\AppData\Local\
Group: Malware file
Last Updated: April 28, 2017
Size: 4.56 KB (4569 bytes)
MD5: e35a5d8aaabaaed5fd6153cf8ead36e6
Detection count: 112
Mime Type: unknown/hta
Group: Malware file
Last Updated: January 27, 2017
%LOCALAPPDATA%trust.exe File name: trust.exe
Size: 64.51 KB (64512 bytes)
MD5: 668c83c1f7f13259ab5d1699ea24d17f
Detection count: 46
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: September 1, 2016
%ALLUSERSPROFILE%How To Recover Encrypted Files.hta File name: How To Recover Encrypted Files.hta
Size: 4.53 KB (4531 bytes)
MD5: f6c1ab1ad892c5e2d48475b2f5dbec9c
Detection count: 23
Mime Type: unknown/hta
Group: Malware file
Last Updated: April 15, 2017
file.exe File name: file.exe
Size: 28.95 KB (28952 bytes)
MD5: a464f7bc0431292d74ad66403efbf691
Detection count: 15
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

File name without pathHow To Recover Encrypted Files.htaHow To Recover Encrypted Files.htmlHow to restore files.htaHOW_OPEN_FILES.htaRead Me Please.htaRegistry keySoftware\Microsoft\Windows\CurrentVersion\Run\How To Recover Encrypted Files

Related Posts

Home Malware Programs Ransomware Globe Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.