Obliterate GlobeImposter Ransomware (Crypto-Malware/Ransomware)

What is GlobeImposter ransomware? And how does it execute its attack?

GlobeImposter ransomware first emerged as a fake version of the notorious Globe ransomware which is why it is also known as FakeGlobe. This fake version has released a new variant that appends the .doc extension to the encrypted files. The new GlobeImposter variant was caught spreading in a new malicious spam email campaign. The malspam emails contain a subject line that starts like “Emailing: IMG_20171221_” which obviously is trying to trick users into thinking that the email contains photos when what’s really inside are 7zip (.7z) archive attachments that are all named after a camera photo’s file name, for instance, IMG_20171228. The 7zip archive attachments contain an obfuscated .js file that when double clicked will cause the ransomware to be downloaded from a remote server and installed on the targeted computer.
Once the malicious executable file for GlobeImposter is downloaded and installed, it will encrypt files with the following file extensions:
.doc, .txt, .0402, .BONUM, .ACTUM, .JEEP, .GRAFF, .trump, .rumblegoodboy, .goro, .au1crypt, .s1crypt, .nCrypt, .hNcrypt, .legally, .keepcalm, .plin, .fix, .515, .crypt, .paycyka, .pizdec, .wallet, .vdulm, .2cXpCihgsVxB3, .medal, .3ncrypt3d .[[email protected]]SON, .troy, .Virginprotection, .BRT92, .725, .ocean, .rose, .GOTHAM, .HAPP, .write_me_[[email protected]], .VAPE, .726, .490, .coded, .skunk, .492, .astra, .apk, .doc, .4035, .clinTON, .D2550A49BF52DFC23F2C013C5, .zuzya, .LEGO, .UNLIS, .GRANNY, .911,.reaGAN, .YAYA .needkeys, .[[email protected]], .foSTE, .490, .ILLNEST, .SKUNK, .nWcrypt, .f41o1, .panda, .BIG1, .GlobeImposter, .kimchenyn, [email protected], .WORK, .crypted_uridzu@aaathats3as_com, [email protected], .TRUE, [email protected], .[[email protected]], .btc, .[[email protected]], [email protected], .black, .[[email protected]], .rrr, .{[email protected]}.AK47, .LIN, .apk, .decoder, .[[email protected]].rose, .fuck, .restorefile, .CHAK, .Chartogy, .POHU, .crypt_fereangos@airmail_cc, [email protected], .crypted_monkserenen@tvstar_com, .crypt_sorayaclarkyo@mail_com, .STN, .VYA, .crypt_damarles@airmail_cc, .pliNGY, .ñ1crypt;
After the encryption, the ransomware appends the .doc extension on each one of the files. Following this, GlobeImposter will also create a ransom note named Read_ME.html in each folder where there is an encrypted file. Here’s the context of the ransom note:
“Your files are Encrypted!
For data recovery needs decryptor.
If you want to buy a decryptor click “Buy Decryptor”
Buy Decryptor
If not working, click again. Free decryption as a guarantee.
Before paying you can send us 1 file for free decryption.
If you can not contact, follow these two steps:

Install the TOP Browser from this link: torproject.org
Open this link in the TOP browser: http://n224ezvhg4sgyamb.onion/sup.php”

How does GlobeImposter ransomware spread its malicious files?
GlobeImposter ransomware spreads using malicious spam email campaigns where the cyber crooks try to disguise the email to make it look like it contains photos and has a subject line of “Emailing: IMG_20171221_”. The email contains 7zip archive files which are all named after a camera photo’s file name.
Refer to the following removal instructions to obliterate GlobeImposter ransomware.
Step 1: Tap Ctrl + Shift + Esc keys to open the Task Manager.

Step 2: After opening the Task Manager, look for GlobeImposter ransomware’s malicious process, right click on it and select End Process or End Task.

Step 3: Close the Task Manager.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 4: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 5: Navigate to the following path:
HKU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Step 6: Look for a value named BrowserUpdateCheck created by GlobeImposter ransomware and delete it.
Step 7: Close the Registry Editor and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 8: Look for GlobeImposter ransomware or any suspicious program and then Uninstall it/them.

Step 9: Tap Win + E to launch File Explorer.
Step 10: After opening File Explorer, navigate to the following locations below and look for GlobeImposter ransomware’s malicious components such as the html file named Read_ME.html as well as the 7zip files and the malicious file GlobeImposter ransomware came with.

%TEMP%
%APPDATA%
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step 11: Close the File Explorer.
Step 12: Empty your Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if GlobeImposter ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Make sure that you have completely removed GlobeImposter ransomware from your computer, to do so, follow the advanced removal guide below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen wll be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.