Globe Imposter ransomware virus - How to remove

Globe Imposter ransomware virus variants continue to splurge and copy the older superior version of Globe infection. The first thing that shows resemblance is the ransom note which is designed in a similar style. Nevertheless, different email addresses that are left as the contact information imply that some variants are not generated by the same people: over the course of 2017, authors of Globe Imposters versions have left these email addresses: [email protected], [email protected], [email protected].

The newest information about GlobeImposter ransomware

Ever since summer of 2017, versions of GlobeImposter crypto-viruses have began popping out like crazy. One of them is the .skunk extension with a payload of svchost.exe. Furthermore, a .gotham extension was also determined to belong to shady developers of the FakeGlobe virus. An A1Lock variant did not escape its fate of being regarded as a part of this family: it left .707 extension on encoded data. Moving further to another variant of FakeGlobe infection, it was determined to append .[email].BRT92 extension and provide a ransom note in HOW_DECRYPT_FILES#.html.

According to some disturbing news (PSCrypt is based on FakeGlobe), PSCrypt ransomware is based on GlobeImposter file-encoder. As it appears, the FakeGlobal crypto-virus was being sold as a RaaS (ransomware as a service).

The GlobeImposter ransomware has been determined to get a boost from malspam (Malware traffic analysis), directed against people from United Stated and European Union. Additionally, Necurs botnet has been supporting the distribution of FakeGlobe ransomware. Necurs had also been noticed to be involved in distribution of Locky. Some security researchers have emphasized that they are pushed in dual spam campaigns (Locky and FakeGlobe).

We are far from being finished unfortunately. We also detected variants that appended .f**k_you_ av_we_are_not_globe_fake, .write_me_[[email protected]]. A funny detail that we noticed was that an older GlobeImposter versions used .ocean extension, but one of the new ones append .sea. In August we also became aware of such extensions like .mtk118, .492 and .coded. While it appears that we will never stop enumerating all of the marks, we do see a light at the end of the tunnel.

Versions of GlobeImposter have also been noticed to append ID numbers as extensions. However, there are more variants that append the same extensions to all of their victims. For instance, in August, there were discoveries of .ACTUM, .BONUM, .NIGGA, .rumblegoodboy and .0402. There was also an innapropriate extension of .f*ck, just without the symbol instead of a letter. An addition string of extensions are there: .GRANNY, .UNLIS, .LEGO, .zuzya, .needdecrypt, .write_on_email, .911, .f41o1, .YAYA, .needkeys, .nWcrypt, .

Then, hackers decided to use names of presidents and incorporate them into their ransomware infections. Therefore, extensions like .ReaGan, .BUSH, .Bill_Clinton@derpymailorg, and .reaGAN. The necessity to learn about these GlobeImposters has been stressed out, explaining that these variants do not stop appearing and will stay as a threat for some time (Facts about FakeGlobe).

Discussion about the variety of samples of FakeGlobe virus

It is getting rather complicated to count all of the extensions that Globe Imposters append to the data it ruins with encryption. One of the most recent examples is a .help addition. The latter variant has been noticed being active in the 2nd of August and its payload is encm3.exe.

On August 1st, another variant stepped out with the extension of .726. The same variant had been active for quite some time before that, but appended .725 instead and implanted RECOVER-FILES-726.html file to launch in victims’ preferred browsers.

On July 31st, another variant of FakeGlobe malware surfaced and it featured .ocean extension, together with the addition of !back_files!.html. Around the same time, malspam campaigns had been noticed to feature executables that brought payloads of Globe Imposters into computers. Necurs botnet was one of the tools which was used to successfully distribute these spam letters.

In some cases, hackers put minimum efforts into convincing people that emails are legitimate. From the looks of it, blank letters were sent around and they did not contain any text, only an attachment. While some email letters could be rather believable, emails that do not contain any text should be immediately red-flagged.

A variant of Globe Imposter called A1Lock was also detected and it was brought to users’ computer via KSSOIFUSIOHRQW.exe payload. It appended .rose extension and implanted “how_to_back_files.html”. This variant was rather different as its .html file opened a message, differing from the previously-discussed samples. We also noticed that [email protected] A sample that appends {email}.BRT92 has also been detected in the wild, accompanied by #HOW_DECRYPT_FILES#.html.

Decryption of these crypto-viruses

Before trying out the possible method for file-recovery, you should get rid of the malware sample that is currently troubling your operating system. Any malware-fighting application will help you, but we recommend Spyhunter. If you don’t do this, the crypto-virus will repeatedly complete the process of file-encryption. If your system has been infected via insecure RDP, you should also change passwords to all of your users.

One of the first Globe Imposter variants appended *.crypt extension. This version is decryptable with Emsisoft Decrypter. Other variants could be crackable as well, but you will have to follow the manual that the service has provided. If that does not work, we suggest trying out other alternatives. We have discussed several of them in the section below.

What strategies do ransomware infections use for distribution?

This chain of crypto-viruses is mainly delivered via spam letters, containing attachments. Of course, other strategies could also be adopted, but the most prevailing tactic is this. Payloads have also been noticed to be delivered via insecure websites or even online advertisements. Unprotected Remote Desktop Protocols also become targets in some cases. If you wish to be immune to the terror that ransomware inflicts, you should try uploading files into backup storages or other locations which can serve you as an alternative source of your digital data.

If the versions in your hard drive become encrypted, it is important to have spare ones. This goes without saying, but do not open messages from email addresses you are not familiar with. Lastly, we remind you that some crypto-viruses can be distributed via social networking sites.

How to recover Globe Imposter ransomware virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Globe Imposter ransomware virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Globe Imposter ransomware virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Globe Imposter ransomware virus. You can check other tools here.  

Step 3. Restore Globe Imposter ransomware virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Globe Imposter ransomware virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Globe Imposter ransomware virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.