GlobeImposter

Aliases: Fake Globe

First seen
2017-12-01 00:00:00
Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-22 04:04:45
Profile updated
2026-07-07 12:54:01

Context

During December 2017, a new variant of the GlobeImposter Ransomware was detected for the first time and reported on malware-traffic-analysis. At first sight this ransomware looks very similar to other ransomware samples and uses common techniques such as process hollowing. However, deeper inspection showed that like LockPoS, which was analyzed by CyberBit, GlobeImposter too bypasses user-mode hooks by directly invoking system calls. Given this evasion technique is being leveraged by new malware samples may indicate that this is a beginning of a trend aiming to bypass user-mode security products.

Detection coverage

  • 2 YARA rules

Detection rules

  • MALPEDIA_Win_Globeimposter_Auto (yara-rule)
  • DITEKSHEN_MALWARE_Win_LOLKEK (yara-rule)

Related threat objects

Reports & references

  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • secureworks.com — Gold Swathmore (report)
  • proofpoint.com — Holiday Lull Not So Much (report)
  • CrowdStrike — Ransomware Preparedness A Call To Action (report)
  • fortinet.com — Analysis Of New Globeimposter Ransomware Variant (report)
  • jsac.jpcert.or.jp — Jsac2020 1 Tamada Yamazaki Nakatsuru En (report)
  • youtube.com — Watch (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 006 (report)
  • blog.intel471.com — A Brief History Of Ta505 (report)
  • intel471.com — A Brief History Of Ta505 (report)
  • isc.sans.edu — 23417 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Globeimposter (report)
  • emsisoft.com — Globeimposter (report)
  • info.phishlabs.com — Globe Imposter Ransomware Makes A New Run (report)
  • asec.ahnlab.com — 48940 (report)
  • blog.ensilo.com — Globeimposter Ransomware Technical (report)
  • sentinelone.com — Recent Tzw Campaigns Revealed As Part Of Globeimposter Malware Family (report)
  • blog.360totalsecurity.com — Globeimposter Which Has More Than 20 Variants Is Still Wildly Growing (report)
  • blog.fortinet.com — Analysis Of New Globeimposter Ransomware Variant (report)
  • acronis.com — Globeimposter Ransomware Holiday Gift Necurs Botnet (report)
  • go.group-ib.com — Group Ib Ransomware Whitepaper Eng (report)
  • asec.ahnlab.com — 30284 (report)
  • bleepingcomputer.com — New Doc Globeimposter Ransomware Variant Malspam Campaign Underway (report)

External references