Threat Database Ransomware Globe3 Ransomware

Globe3 Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Ranking: 16,940
Threat Level: 100 % (High)
Infected Computers: 49,612
First Seen: August 24, 2016
Last Seen: July 9, 2023
OS(es) Affected: Windows

The Globe3 Ransomware is a variant in the Globe Ransomware family that is themed after the popular movie 'The Purge.' The Globe3 Ransomware uses a ransom note, and Desktop picture themed after this movie and appends the extension '.purge' to each file affected during the attack. The Globe3 Ransomware is a typical encryption ransomware variant. The Globe3 Ransomware encrypts the victims' files using a strong encryption method. The Globe3 Ransomware then displays a ransom note that demands that the victim pays a large sum in exchange for the decryption key needed to recover the affected files. Fortunately, PC security analysts have released a decryption utility that can help computer users recover their files after a the Globe3 Ransomware infection.

The Globe3 Ransomware is Another Member of Its Ever-Growing Family

It is likely that the Globe3 Ransomware spreads using spam email attachments. Once the Globe3 Ransomware infects a computer, it first ensures that it is not running on a virtual machine or sandbox environment, used by PC security researchers to test and examine threats in a controlled environment. Once the Globe3 Ransomware determines that it is running on a non-sandbox operating system, it begins its attack, encrypting files on local drives, shared network folders, and external memory devices connected to the infected computer. The Globe3 Ransomware targets nearly one thousand different file types, searching for files that match a list of file extensions in its configuration settings and encrypting them using the Blowfish encryption. After encrypting a file, the Globe3 Ransomware adds the extension '.purge' to the end of the file's name, making it simple to know which files have been affected by the attack.

The Globe3 Ransomware’s Ransom Note

The Globe3 Ransomware delivers its ransom note in an HTA file named 'How to restore files.hta' dropped in most directories where files were encrypted. The Globe3 Ransomware changes the affected computer's settings to allow the HTA file to run automatically when Windows starts up. The Globe3 Ransomware's ransom note includes an ID for the infected computer and the Globe3 Ransomware's creator's email address. Below is the full text of the Globe3 Ransomware ransom note:

'Your files are encrypted!
Your personal ID
Your documents, photos, databases, save games and other important data has been encrypted.
Data recovery is required interpreter.
To get the interpreter should pay its costs: 3 Bitcoin (3 BTC).
Cash must be translated into Bitcoin-purse: 18XXV3h9zzzJ1R4v6DiGmfgcooG1Vk9B1m
If you have no Bitcoin
Create a wallet Bitcoin:
Get cryptocurrency Bitcoin: (Visa/MasterCard, QIWI Visa Wallet \xE8 \xE4\xF0.)\xCF\xF0\xE8\xEE\xE1\xF0\xE5\xF2\xE5\xED\xE8\xE5_\xE1\xE8\xF2\xEA\xEE\xE9\xED\xEE\xE2(instruction for beginners)
Send 3 BTC bitcoin address 18XXV3h9zzzJ1R4v6DiGmfgcooG1Vk9B1m
After the payment, send an e-mail address In a letter to indicate your personal identifier.
In a response letter you will receive a program to decrypt.
After start-interpreter program, all your files will be restored.
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders are not compatible with other users of your data because each user's unique encryption key.'

Apart from the ransom note, the Globe3 Ransomware will change the infected computer's Desktop image so that it displays characters from 'The Purge: Election Year,' as well as the message 'You files are encrypted. Pay for decryption please' and the email address

Dealing with the Globe3 Ransomware

Oddly enough, the Globe3 Ransomware includes a debug mode that has helped PC security analysts study how the Globe3 Ransomware works. This has allowed PC security analysts to release a decryption utility to help computer users deal with the Globe3 Ransomware. The decryptor has been confirmed with the Globe3 Ransomware variants that use the extensions .decrypt2017 and .hnumkhotep to identify the encrypted files. However, it is very likely that this decryption utility will work with other variants of the Globe3 Ransomware. PC security analysts advise computer users to ensure that backups of all files are maintained to mitigate the damage of any future ransomware attacks, especially those involving threats for which no decryption utility is available.

SpyHunter Detects & Remove Globe3 Ransomware

File System Details

Globe3 Ransomware may create the following file(s):
# File Name MD5 Detections
1. !!! READ THIS - IMPORTANT !!!.hta 71b5bde6378a2a78890d0e97e68a509f 1,907
2. How to restore files.hta 36e82400a1471d26845799b4e84e39e8 1,366
3. !!! READ THIS - IMPORTANT !!!.hta 2b7bd31fd3447cd1b0e0bdfd690b0740 442
4. How to restore files.hta b878021fc79732a224496a079368d3af 251
5. How to restore files.hta e0ef5ddabbaeccbff633b2ae59761125 120
6. !!! READ THIS - IMPORTANT !!!.hta b1ced26e230b558f632f154388a28206 95
7. How To Recover Encrypted Files.hta 553c06dcdcf8215e827e086932fdda9b 64
8. How to restore files.hta f8fb7de9e6631fb2282fd4b5cc0a6a39 55
9. How to restore files.hta 876c0e750191be1b6bfbcaf08d4bcf29 47
10. How to restore files.hta 5bee874338372d37a1e90fa3066235fb 32
11. How to restore files.hta b6e7a3d306ec4dae355cfefc506c3d46 31
12. How to restore files.hta b9a236156344554fa06377d84b702a68 25
13. How to restore files.hta ac9e4795b2c1256bbafa1f1ed1468ae0 24
14. How to restore files.hta bb782e8deb0efc78549a1f5c44da0adc 24
15. How to restore files.hta 89f48f5403dd8daa9adeccb6dc04c30f 24
16. How to restore files.hta b5c01e1bd2b9b6fec75ad52bf06a1bab 24
17. How to restore files.hta 11370076a57e9ef6820cbe4890e36681 24
18. How to restore files.hta c9984b49079e115c03facb65cd4a44a3 16
19. How to restore files.hta 95e3c291f18dcf4654c211a1d64a95c3 11
20. How to restore files.hta 024074f49218168ffaf0d0f08db1add8 8
21. How to restore files.hta e77da836d1a42580345a3825111af71a 3
22. How to restore files.hta 9c0f010c33c9bd395602c8791f4ad080 3
23. How to restore files.hta 515391c5bd9e804a71720fe80ad12813 3
24. How to restore files.hta 0c8676762e22ed3a6cd59ce37068c30d 2
25. How to restore files.hta 503478dce7398eac1ce8cc7db0fea7b9 1
26. file.exe a464f7bc0431292d74ad66403efbf691 0
More files

Registry Details

Globe3 Ransomware may create the following registry entry or registry entries:
File name without path
How To Recover Encrypted Files.hta
How To Recover Encrypted Files.html
How to restore files.hta
Read Me Please.hta
Software\Microsoft\Windows\CurrentVersion\Run\How To Recover Encrypted Files


Most Viewed