Malware News Crypt GlobeImposter Ransomware Distributed via Blank Slate Malspam

[LASER_oneXM]

The "Blank Slate" malspam campaign has switched from distributing the Aleta BTCware variant to distributing a GlobeImposter variant that appends the .crypt extension. This malspam campaign is called Blank Slate due to the lack of a subject line and message body in the spam emails.

These malspam emails contain ZIP attachments that are named using the format EMAIL_[RandomNumbers]_[RecipientName].zip. Inside this zip file is another zip file with a name like [RandomNumbers].zip. This zip file then contains a random named obfuscated JS script. So an example attachment progression would be something like EMAIl_877821_Bleeping.zip -> 871231.zip -> msaSh.js.

When executed, this JS script will attempt to download a file called 1.dat, which is a actually an executable file, from one of two designated sites.

An interesting characteristic of the current downloaded malware executable is that it is code signed using a certificate issued by thawte.

Unfortunately, at this time there is no way to decrypt GlobeImposter files for free. For support or help with this ransomware infection, you can ask in our dedicated GlobeImposter Ransomware Support topic.

 

[Solarquest]

Antivirus scan for 2df19df0a0b0c683c6cb9421bdad6e0bdb62bd6380cce4f75501cac653ca5be4 at 2017-07-31 18:02:17 UTC - VirusTotal