Source: hdwallpapers.in


With both Pokemon and Mr. Robot based ransomware released this month, integrating pop culture into ransomware is a dominant theme this month. The new Globe Ransomware is no exception with malware developers basing their ransomware on the popular Purge movies. With a Purge based based wallpaper and adding the .purge extension to encrypted files, the malware developer was clearly inspired by the movies.

Discovered by Emsisoft security researcher xXToffeeXx, the Globe Ransomware acts just like other ransomware. It will encrypt a victim's files and then display a ransom note. Unlike most other ransomware, though, Globe uses the Blowfish encryption algorithm rather the commonly used AES encryption. Furthermore, instead of a text and html ransom note, the Globe Ransomware uses a HTA, or HTML Application, file to display the ransom note.

This ransomware is currently being analyzed for weaknesses and it may be possible to create a free decryptor. If you are affected by this ransomware, please post in the .  As news is released, it will be posted to that topic.

Update 8/26/16: Can possibly be decrypted. More research is being done.

How the Globe Ransomware Encrypts a Victim's Computer

At this time it is not known how the Globe Ransomware is distributed. Once it is installed, it will check to see if the computer is running within a sandbox or virtual machine such as Anubis, VirtualBox, VMware, or Virtual PC, and if it is, the process will be terminated.

If there is no sandbox present, the ransomware will begin to encrypt the victim's user profile, local drives, shared network folders, and then the victim's desktop folder.  When it encounters a file with one of the 995 targeted extensions1, it will encrypt it using Blowfish encryption and append the .purge extension to the encrypted file. For example, the file test.jpg would be renamed test.jpg.purge when it is encrypted.

When it encrypts a file it will create a HTA ransom note called How to restore files.hta in the same folder as the encrypted files. It will also create a autorun called How to restore files that automatically opens the HTA ransom note located in the victim's %UserProfile% when they login to Windows.

During the encryption process, the ransomware will also delete the Shadow Volume Copies and disable Windows Startup Repair using these commands:

vssadmin.exe Delete Shadows /All /Quiet                                                                                                                                                               
bcdedit.exe /set {default} recoveryenabled No                                                                                                                                                         
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures                                                                                                                                         

Finally when the ransomware is done it open the How to restore files.hta and displays it to the victim. This ransom note contains a unique ID associated with the victim and contact information for the developer.  The current contact information for the developer is the powerbase@tutanota.com email and the BM-2cUrKsazEKiamN9cZ17xQq9c5JpRpokca5 bitmessage address.

Globe Ransomware Ransom Note
Globe Ransomware Ransom Note

The ransom note instructions the victim to contact the developer with their personal ID to get payment instructions.

Last, but not least, the ransomware will change the Windows wallpaper to display a background containing characters from the Purge: Election Year movie.

Purge Wallpaper
Purge Wallpaper

This wallpaper will state "You files are encrypted. Pay for decryption please" and then contains the powerbase@tutanota.com email address.

Debugging the Globe Ransomware

An interesting feature of the Globe Ransomware is that it contains a debug mode that can be used to step through each stage of the ransomware encryption process. To enter debug mode, you need to create a special Registry value before executing the ransomware. This value is:

HKCU\Software\Globe\ "debug" = "YES"

If that registry entry is created and the ransomware is executed, it will do so in debug mode. This debug mode will prompt you to allow various stages to begin as the ransomware executes. Some of these stages can be seen below.

Debug: Start Working
Debug: Start Working
Debug: Add to Autostart
Debug: Add to Autostart
Debug: Encrypt a file
Debug: Encrypt a file

This mode was created to help the developer debug their application. At the same time, it allows security researchers to easily analyze the various stages of this ransomware.

Files associated with the Globe Ransomware:

How to restore files.hta
%UserProfile%\AppData\Local\msiscan.exe
%UserProfile%\How to decrypt your files.jpg

Registry entries associated with the Globe Ransomware:

HKCU\Software\Globe
HKCU\Software\Globe\ "idle"
HKCU\Software\Globe\ "debug"
HKCU\Control Panel\Desktop\ "Wallpaper"	"%UserProfile%\How to decrypt your files.jpg"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "How to restore files" = "mshta.exe "%UserProfile%\How to restore files.hta""

Targeted File Extensions

aet,afp,agd1,agdl,ai,aif,aiff,aim,aip,ais,ait,ak,al,allet,amf,amr,amu,amx,amxx,ans,aoi,ap,ape,api,apj,apk,apnx,arc,arch00,ari,arj,aro,arr,arw,as,as3,asa,asc,ascx,ase,asf,ashx,asm,asmx,asp,aspx,asr,asset,asx,automaticdestinations-ms,avi,avs,awg,azf,azs,azw,azw1,azw3,azw4,b2a,back,backup,backupdb,bad,bak,bank,bar,bay,bc6,bc7,bck,bcp,bdb,bdp,bdr,bfa,bgt,bi8,bib,bic,big,bik,bin,bkf,bkp,bkup,blend,blob,blp,bmc,bmf,bml,bmp,boc,bp2,bp3,bpk,bpl,bpw,brd,bsa,bsk,bsp,btoa,bvd,c,cag,cam,camproj,cap,car,cas,cat,cbf,cbr,cbz,cc,ccd,ccf,cch,cd,cdf,cdi,cdr,cdr3,cdr4,cdr5,cdr6,cdrw,cdx,ce1,ce2,cef,cer,cert,cfg,cfp,cfr,cgf,cgi,cgm,cgp,chk,chml,cib,class,clr,cls,clx,cmf,cms,cmt,cnf,cng,cod,col,con,conf,config,contact,cp,cpi,cpio,cpp,cr2,craw,crd,crt,crw,crwl,crypt,crypted,cryptra,cs,csh,csi,csl,cso,csr,css,csv,ctt,cty,cue,cwf,d3dbsp,dac,dal,dap,das,dash,dat,database,dayzprofile,dazip,db,db_journal,db0,db3,dba,dbb,dbf,dbfv,db-journal,dbx,dc2,dc4,dch,dco,dcp,dcr,dcs,dcu,ddc,ddcx,ddd,ddoc,ddrw,dds,default,dem,der,des,desc,design,desklink,dev,dex,dfm,dgc,dic,dif,dii,dim,dime,dip,dir,directory,disc,disk,dit,divx,diz,djv,djvu,dlc,dmg,dmp,dng,dob,doc,docb,docm,docx,dot,dotm,dotx,dox,dpk,dpl,dpr,drf,drw,dsk,dsp,dtd,dvd,dvi,dvx,dwg,dxb,dxe,dxf,dxg,e4a,edb,efl,efr,efu,efx,eip,elf,emc,emf,eml,enc,enx,epk,eps,epub,eql,erbsql,erf,err,esf,esm,euc,evo,ex,exf,exif,f90,faq,fcd,fdb,fdr,fds,ff,ffd,fff,fh,fhd,fla,flac,flf,flp,flv,flvv,for,forge,fos,fpenc,fpk,fpp,fpx,frm,fsh,fss,fxg,gam,gdb,gfe,gfx,gho,gif,gpg,gray,grey,grf,groups,gry,gthr,gxk,gz,gzig,gzip,h,h3m,h4r,hbk,hbx,hdd,hex,hkdb,hkx,hplg,hpp,hqx,htm,html,htpasswd,hvpl,hwp,ibank,ibd,ibz,ico,icxs,idl,idml,idx,ie5,ie6,ie7,ie8,ie9,iff,iif,iiq,img,incpas,indb,indd,indl,indt,ink,inx,ipa,iso,isu,isz,itdb,itl,itm,iwd,iwi,jac,jar,jav,java,jbc,jc,jfif,jge,jgz,jif,jiff,jnt,jpc,jpe,jpeg,jpf,jpg,jpw,js,json,jsp,just,k25,kc2,kdb,kdbx,kdc,kde,key,kf,klq,kmz,kpdx,kwd,kwm,laccdb,lastlogin,lay,lay6,layout,lbf,lbi,lcd,lcf,lcn,ldb,ldf,lgp,lib,lit,litemod,lngttarch2,localstorage,log,lp2,lpa,lrf,ltm,ltr,ltx,lua,lvivt,lvl,m,m2,m2ts,m3u,m3u8,m4a,m4p,m4u,m4v,mag,man,map,mapimail,max,mbox,mbx,mcd,mcgame,mcmeta,mcrp,md,md0,md1,md2,md3,md5,mdb,mdbackup,mdc,mddata,mdf,mdl,mdn,mds,mef,menu,meo,mfw,mic,mid,mim,mime,mip,mjd,mkv,mlb,mlx,mm6,mm7,mm8,mme,mml,mmw,mny,mobi,mod,moneywell,mos,mov,movie,moz,mp1,mp2,mp3,mp4,mp4v,mpa,mpe,mpeg,mpg,mpq,mpqge,mpv2,mrw,mrwref,mse,msg,msi,msp,mts,mui,mxp,myd,myi,nav,ncd,ncf,nd,ndd,ndf,nds,nef,nfo,nk2,nop,now,nrg,nri,nrw,ns2,ns3,ns4,nsd,nsf,nsg,nsh,ntl,number,nvram,nwb,nx1,nx2,nxl,nyf,oab,obj,odb,odc,odf,odg,odi,odm,odp,ods,odt,oft,oga,ogg,oil,opd,opf,orf,ost,otg,oth,otp,ots,ott,owl,oxt,p12,p7b,p7c,pab,pack,pages,pak,paq,pas,pat,pbf,pbk,pbp,pbs,pcd,pct,pcv,pdb,pdc,pdd,pdf,pef,pem,pfx,php,pkb,pkey,pkh,pkpass,pl,plb,plc,pli,plus_muhd,pm,pmd,png,po,pot,potm,potx,ppam,ppd,ppf,ppj,pps,ppsm,ppsx,ppt,pptm,pptx,prc,prel,prf,props,prproj,prt,ps,psa,psafe3,psd,psk,pspimage,pst,psw6,ptx,pub,puz,pwf,pwi,pwm,pxp,py,qba,qbb,qbm,qbr,qbw,qbx,qby,qcow,qcow2,qdf,qed,qel,qic,qif,qpx,qt,qtq,qtr,r00,r01,r02,r03,r3d,ra,ra2,raf,ram,rar,rat,raw,rb,rdb,rdi,re4,res,result,rev,rgn,rgss3a,rim,rll,rm,rng,rofl,rpf,rrt,rsdf,rsrc,rsw,rte,rtf,rts,rtx,rum,run,rv,rvt,rw2,rwl,rwz,rzk,rzx,s3db,sad,saf,safe,sas7bdat,sav,save,say,sb,sc2save,sch,scm,scn,scx,sd0,sd1,sda,sdb,sdc,sdf,sdn,sdo,sds,sdt,search-ms,sef,sen,ses,sfs,sfx,sgz,sh,shar,shr,shw,shy,sid,sidd,sidn,sie,sis,sldm,sldx,slk,slm,slt,sme,snk,snp,snx,so,spd,spr,sql,sqlite,sqlite3,sqlitedb,sqllite,sqx,sr2,srf,srt,srw,ssa,st4,st5,st6,st7,st8,stc,std,sti,stm,stt,stw,stx,sud,suf,sum,svg,svi,svr,swd,swf,switch,sxc,sxd,sxg,sxi,sxm,sxw,syncdb,t01,t03,t05,t12,t13,tar,tax,tax2013,tax2014,tbk,tbz2,tch,tcx,tex,text,tg,tga,tgz,thm,thmx,tif,tiff,tlg,tlz,toast,tor,torrent,tpu,tpx,trp,ts,tu,tur,txd,txf,txt,uax,udf,uea,umx,unity3d,unr,unx,uop,uot,upk,upoi,url,usa,usx,ut2,ut3,utc,utx,uu,uud,uue,uvx,uxx,val,vault,vbox,vbs,vc,vcd,vcf,vdf,vdi,vdo,ver,vfs0,vhd,vhdx,vlc,vlt,vmdk,vmf,vmsd,vmt,vmx,vmxf,vob,vp,vpk,vpp_pc,vsi,vtf,w3g,w3x,wab,wad,wallet,war,wav,wave,waw,wb2,wbk,wdgt,wks,wm,wma,wmd,wmdb,wmmp,wmo,wmv,wmx,wotreplay,wow,wpd,wpe,wpk,wpl,wps,wsh,wtd,wtf,wvx,x11,x3f,xf,xis,xl,xla,xlam,xlc,xlk,xll,xlm,xlr,xls,xlsb,xlsm,xlsx,xlt,xltm,xltx,xlv,xlw,xlwx,xml,xpi,xps,xpt,xqx,xsl,xtbl,xvid,xwd,xxe,xxx,yab,ycbcra,yenc,yml,ync,yps,yuv,z02,z04,zap,zip,zipx,zoo,zps,ztmp,cry,a 

IOCs:

SHA256:	98aadc95c589e064a542802bbf0ef01ef00595c34d195f1a1e6443909846d2e7