GlobeImposter Ransomware

Quick facts

Ransomware Family

GlobeImposter

First Seen

December 1, 2016

Known Aliases

• Fake Globe
• GlobeImposter NextGen
• FakeGlobeImposter
• GlobeImposterImitator

How GlobeImposter ransomware works

File modification behavior

GlobeImposter updates file modification timestamps after encryption.

File encryption patterns

GlobeImposter modifies encrypted files using specific patterns to mark them as encrypted:

Ransom note and payment demands

After encrypting files, GlobeImposter displays ransom notes demanding payment for file recovery:

notes/Help Restore.hta

notes/recover files.hta

notes/read_it.txt

notes/read-me.txt

notes/how_to_back_files.html

notes/RECOVERY_DARKBIT.txt

notes/Read___ME.html

notes/free_files!.html

notes/RECOVER-FILES.html

notes/MESSAGE.html

notes/#HOW_DECRYPT_FILES#.html

notes/$DECRYPT_YOUR_FILES$.html

notes/!back_files!.html

notes/here_your_files!.html

notes/Read_Me.html

notes/!your_files!.html

notes/YOU_FILES_HERE.txt

notes/!SOS!.html

notes/READ_IT.html

notes/HELP.hta

notes/instructions.html

notes/READ_ME.txt

notes/READ__ME.html

notes/Read_ME.html

notes/HOW_TO_BACK_FILES.txt

notes/support.html

notes/Restore-My-Files.txt

notes/HOW_RECOVER.html

notes/!INSTRUCTI0NS!.TXT

notes/how_to_open_files.html

notes/help you.txt

notes/Decryption INFO.html

notes/!!!HOW_TO_BACK_FILES!!!.html

Technical indicators

Associated executable files

The following executable files are associated with GlobeImposter ransomware:

• cyber_chinya.exe
• подтверждение.exe
• gen_vk.exe
• 2-0.5.exe
• oni.exe
• oni.exe_org
• 9b.exe
• d104.exe
• kqhtzxaerb.exe
• StandardSignals
• Shown
• spacelol.kaf_decrypted
• ???? - ????? ????????.scr
• DOCU11072017 - ?????.scr
• Июль - новый документ.scr
• Копия за июль.scr
• DOCU11072017 - копия.scr
• file.scr
• Июль - новый документ.scr
• - .scr
• Trojan.Ransom.GlobeImposter.exe
• Purgen.exe
• GlobeImposter_Gotham_Variant.exe
• svchost.exe
• globeimposter_gotham_variant.exe
• GlobeImposter_Happ_or_Crypt_Variant.exe
• PascalABCNET.exe
• 26591.exe
• executable.exe
• HPLaserJetService.exe
• globe.exe
• 3
• 3.2
• INV-000342.vbs
• System.exe
• 1.dat
• 113810.exe
• 174394.exe
• 1.dat.exe
• Modifiable Irqs
• Interl thesaurus service.exe
• 30.exe
• 30.11.2017.scr
• 30 ???????.scr
• 2.exe
• 30 .scr
• 30 октября.scr
• globeimposter.exe
• 1.exe
• moi_09_11_2017.exe
• chess.exe.old
• chess.exe
• GlobeImposter.exe
• 06c82e99.gxe
• UYTd46732
• UYTd46732.exe
• 06.12.17.scr
• 06.12.17 ?????.scr
• 06.12.scr
• tOldHSYW
• file.exe
• rWRCCRTqJ2.exe
• tOldHSYW.exe
• a (144).exe
• virus (110).exe
• 3c701aa9.gxe
• myfile.exe
• toldhsyw.exe
• Nbd
• 22 ??????.scr~.~VIRUS~
• 22 ??????.scr
• 22 января 2018.scr
• 22 янв.scr
• 22 ???????????.scr
• 22 янв.xxx
• 22 янв.scr (3)
• 22 ?????? 2018.scr
• 22 .scr
• 22 ???.scr
• 64secondmix.exe
• service_viewer.exe
• IntelManagerService.exe
• suspect01.exe
• Resume.doc.bin
• conhost.exe
• cmd
• Intel Core Update.exe
• globeimposter
• SEXY3.EXE
• 勒索.exe
• test_v.doc
• svhost.exe
• font.bin
• font.exe
• 1anami2.exe
• abat.exe
• cmd.exe
• _ski_.exe
• BulkFileChanger
• BulkFileChanger.exe
• 43755.exe_
• graf
• Graf_b2.exe
• velasquez.joeli.exe
• TlJjg.bin
• rdfg546fgh.exe
• dplaysvr.exe
• ChromeSetup.exe
• 9CXZLII4.exe
• _lio_.exe
• DJ0507.EXE
• tanos.exe
• Erenahen.exe
• _gke_.exe
• _ayr_.exe
• d_upd1008.exe
• SYSTEM.EXE
• lorena.bin
• HAPPYTHREE.EXE
• _aro.exe
• __aro.bin
• lockisdog.bin
• lockisdog.exe
• _yosKa4_.exe
• IntelTheasurusService.exe
• lock.exe
• HAPPYTHREE.EXE.exe
• winlogon.exe
• bit.exe
• sb_373999_bs
• 8curse.exe
• 重要書類.exe
• darkbit.exe
• Tenorshare 4mekeyy.exe
• wlnlogon.exe
• TuRKey_RanSOmWarE.exe
• System.ini.exe
• TuRKey_RanSOmWarE.bin
• Netflorist Coupon Generator.exe
• Netflorist.exe
• f0l883C310jlvRp.exe
• clown.exe
• ETH 200.exe
• sql_service.exe
• software.exe
• star.exe
• 1[1].dat
• apkcrypt.exe
• zmt.exe
• rooster4444.exe
• xrzrgjts.exe
• ADOBE ACROBAT UPDATE SERVICE.EXE
• FastEncrypt.EXE
• _nak_.exe

Recovery and decryption tools

Decryption tools may be available for GlobeImposter. Review the resources below:

• GlobeImposter decryptor

About this analysis

This GlobeImposter ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery, helping organizations defend against and recover from ransomware attacks like GlobeImposter.

Last updated: May 28, 2025