The "Blank Slate" malspam campaign has switched from distributing the Aleta BTCware variant to distributing a GlobeImposter variant that appends the .crypt extension. This malspam campaign is called Blank Slate due to the lack of a subject line and message body in the spam emails.
These malspam emails contain ZIP attachments that are named using the format EMAIL_[RandomNumbers]_[RecipientName].zip. Inside this zip file is another zip file with a name like [RandomNumbers].zip. This zip file then contains a random named obfuscated JS script. So an example attachment progression would be something like EMAIl_877821_Bleeping.zip -> 871231.zip -> msaSh.js.
When executed, this JS script will attempt to download a file called 1.dat, which is a actually an executable file, from one of two designated sites.
An interesting characteristic of the current downloaded malware executable is that it is code signed using a certificate issued by thawte.