GlobeImposter Ransomware Support (.Crypt & .PSCrypt ext - !back_files!.html)

Tired Globe Decrypter not working.
 
All Extension has become .FIX
 
 
 
All your files have been encrypted due to a security problem with your PC.
To restore all your files, you need a decryption.
If you want to restore them, write us to the e-mail happydaayz@aol.com.
Or you can, write us to the e-mail strongman@india.com.
In a letter to send Your personal ID (see In the beginning of this document).
You have to pay for decryption in Bitcoins.
The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.
In the letter, you will receive instructions to decrypt your files!

In a response letter you will receive the address of Bitcoin-wallet, which is necessary to perform the transfer of funds.
HURRY! Your personal code for decryption stored with us only 72 HOURS!


Our tech support is available 24 \ 7

• Do not delete: Your personal ID
• Write on e-mail, we will help you!

Free decryption as guarantee
Before paying you can send to us up to 3 files for free decryption.
Please note that files must NOT contain valuable information and their total size must be less than 10Mb.
When the transfer is confirmed, you will receive interpreter files to your computer.
After start-interpreter program, all your files will be restored.

Looks to not be Globe3 because the ID pattern in the note is incorrect (sorry, ID Ransomware should have filtered that out, I will look into it).

 

It looks like it could be GlobeImposter, or a new variant of HappyDayzz, which we don't have a lot of info on at the moment as we don't have a sample.

 

https://www.bleepingcomputer.com/forums/t/642559/happydayzz-blackjockercryptergmailcomhexhappydayzz-ransomware-help-topic/

I have a encrypted and decrypted file sample. Its does not change the filename. Its adds .FIX extension

You may zip up encrypted/original pairs and submit them here: http://www.bleepingcomputer.com/submit-malware.php?channel=168

 

More importantly, if you can get the malware, that would be best for analysis so we can confirm.

 

We are leaning more towards this being a variant of GlobeImposter, which newer versions cannot be decrypted.

Hi dilip_nowin,

 

Any news about your infection??

 

I got infected too.....  

Hi dilip_nowin,

 

Any news about your infection??

 

I got infected too.....  

 

Still Waiting.

 

You may also zip up encrypted/original pairs and submit them here: http://www.bleepingcomputer.com/submit-malware.php?channel=168

 

Mine malware was self deleted. If u have that malware file. send it to above link. So that we can get a solution sooner

Please be patient until one of our crypto malware experts has a chance to review the information provided. BleepingComputer is inundated with support requests and assistance may take some time. Staff members & Security Colleagues are all volunteers who assist members as time permits.

We've confirmed this is GlobeImposter 2.0, so it is secure. Afraid you can only restore from backups.

Hi,

 

My laptop was infected with a ransomware yesterday, after opening an exe file that turned out to be a virus. All files have the correct name and size with an extension of Virginlock. I uploaded a test file to ID Randsomeware, and the site did not find a match and has no information about it.

 

Kindly find below an image of the background.

 

//imgur.com/xwcfbmh

<script async src="//s.imgur.com/min/embed.js" charset="utf-8"></script>

 

Please let me know if you need more information

 

Another user uploaded that extension along with the ransom note "how_to_back_files.html", which was a GlobeImposter 2.0 note. I'm afraid it is not decryptable. I've updated rules for it.

Hello Team, 

 

We just been infected too by this Ransomware, do you have any news or progress regarding what we have to do ?

 

Thanks for your prompt answer and best regards

 

Jullll

GlobeImposter 2.0 is not decryptable. You can only restore from backups, or archive your encrypted files in hopes for the future.

Thanks Demonslay335 but bad new news for us ....

 

Maybe a last question for you : How can I be sure that I'm well infected by this Ransomwar ?

Edited by jullll, 17 April 2017 - 12:59 PM.

You can submit samples of encrypted files and ransom notes to ID Ransomware for assistance with identification and confirmation. This is a service that helps identify what ransomware may have encrypted your files. Uploading both encrypted files and ransom notes together provides a more positive match and helps to avoid false detections.

Hello-
  This past Tuesday night, I was hit with some ransomware that encrypted all the files on my computer with the extension *.nCrypt. When I uploaded an encrypted file to the id-ransomware site, it was unable to determine what it was, with the reference "SHA1: a762efe08c7b19f8dc82d6ba444c71621d29e9d6" I also tried uploading the ransom note, and it came back with 2 results: GlobeImposter 2.0 and GlobeImposter. Naturally I did a little bit of research on those and the ransom note I have looks much different from that one, the one I have doesn't even say how much money to give them, just to e-mail them to find out. Any help I can receive would be greatly appreciated.
 
Thanks in advance for any assistance anyone can provide!
 
here is the ransom note that was left: