Malware News Crypt GlobeImposter Ransomware Distributed via Blank Slate Malspam

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Feb 4, 2016
2,520
The "Blank Slate" malspam campaign has switched from distributing the Aleta BTCware variant to distributing a GlobeImposter variant that appends the .crypt extension. This malspam campaign is called Blank Slate due to the lack of a subject line and message body in the spam emails.

These malspam emails contain ZIP attachments that are named using the format EMAIL_[RandomNumbers]_[RecipientName].zip. Inside this zip file is another zip file with a name like [RandomNumbers].zip. This zip file then contains a random named obfuscated JS script. So an example attachment progression would be something like EMAIl_877821_Bleeping.zip -> 871231.zip -> msaSh.js.

When executed, this JS script will attempt to download a file called 1.dat, which is a actually an executable file, from one of two designated sites.

An interesting characteristic of the current downloaded malware executable is that it is code signed using a certificate issued by thawte.

Unfortunately, at this time there is no way to decrypt GlobeImposter files for free. For support or help with this ransomware infection, you can ask in our dedicated GlobeImposter Ransomware Support topic.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top