malware family

Globe

unknownentity:malware_familyransomware · 1 source

Globe is a ransomware family that first appeared in August 2016, notable for its highly customizable codebase that allows operators to configure ransom note text, encryption algorithms, and file extensions. Globe uses symmetric encryption (RC4 or AES) to lock files and typically appends custom extensions such as .GLOBE, .PURPLE, .HNY, or others set by the attacker. The malware is distributed through malicious spam emails with infected attachments, compromised websites, and exploit kits. Globe’

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: globe
kind: malware family
status: unknown
aliases: —
jurisdictions: —
claims naming it: 132 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy c6092d3e-8aef-58dd-8f9e-1c77768cea95via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 20 of 132

Globeransomwarepayment
subjecttransaction993fab486d…e5688974d7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1EDG61uWUrsHQYUrBJABHHDCXv2MLJWiWs · 28,195,359 sat · time 2016-10-23 11:20 UTC · url https://ransomwhe.re/#address/1EDG61uWUrsHQYUrBJABHHDCXv2MLJWiWs
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23835btcintel:annotations:23835@v3 sha256:9ebf2d3a67c87a58
confidencetrusted provider · 50
Globeransomwarepayment address
subjectaddress1EDG61uWUrsHQYUrBJABHHDCXv2MLJWiWs
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Globe · url https://ransomwhe.re/#address/1EDG61uWUrsHQYUrBJABHHDCXv2MLJWiWs
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_23834btcintel:annotations:23834@v2 sha256:c5dbc8a70cb3d133
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction8e1d43cb70…271073d665
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 697,873 sat · time 2016-06-05 19:47 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23720btcintel:annotations:23720@v3 sha256:6ab5d3b8933a9bdd
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransactione29b56f264…3dd0b6d71f
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,398,601 sat · time 2016-06-05 21:57 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23719btcintel:annotations:23719@v3 sha256:43b9438ec2445153
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction73926e4ed8…3cdcb05370
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,564,214 sat · time 2016-06-06 18:34 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23718btcintel:annotations:23718@v3 sha256:7b68deac45cc5851
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction5f03537b19…fd972d31d9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 521,976 sat · time 2016-06-06 19:02 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23717btcintel:annotations:23717@v3 sha256:4bc5583f465af399
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction2ae3c1b196…c109626c4d
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,061,385 sat · time 2016-06-07 19:39 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23716btcintel:annotations:23716@v3 sha256:964186cb0647db9c
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction823eacb961…90529b1182
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,226,994 sat · time 2016-06-08 19:15 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23715btcintel:annotations:23715@v3 sha256:a447727f5032f1f6
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction3a2fbe4981…bda331a9a4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,249,864 sat · time 2016-06-09 17:07 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23714btcintel:annotations:23714@v3 sha256:df7674b742922fd1
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction5377a740f9…d01bf37012
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 882,130 sat · time 2016-06-10 20:45 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23713btcintel:annotations:23713@v3 sha256:8fac8a5beae14499
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransactionbee8984ce8…f223732a50
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,056,381 sat · time 2016-06-11 21:50 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23712btcintel:annotations:23712@v3 sha256:cb8b1695da0780c8
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction554653bd68…394f5db796
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,297,017 sat · time 2016-06-12 19:02 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23711btcintel:annotations:23711@v3 sha256:4648ad18c82c967e
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction0916f0e329…18aae6ac45
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 890,208 sat · time 2016-06-13 19:18 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23710btcintel:annotations:23710@v3 sha256:f6a6bd65fe5c1198
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransactionda1c7d03b4…e2df0f2af0
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 297,567 sat · time 2016-06-14 21:19 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23709btcintel:annotations:23709@v3 sha256:cbf33a26bd42edca
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransactiona99703261a…a4b90f7496
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,795,411 sat · time 2016-06-18 22:36 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23708btcintel:annotations:23708@v3 sha256:cae9f90527447f89
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransactiona03befbf14…079965e2a6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,278,146 sat · time 2016-06-20 22:39 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23707btcintel:annotations:23707@v3 sha256:45f4f641b8d5cd8e
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction2476242094…b7b329afa6
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 3,333,878 sat · time 2016-06-24 21:09 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23706btcintel:annotations:23706@v3 sha256:dcd5ae682c63cf8d
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction22d40bb54c…1fd1a79724
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 462,963 sat · time 2016-06-25 13:50 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23705btcintel:annotations:23705@v3 sha256:9b2e3a32f5ebebd0
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction6b082dcda8…e84928466b
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 957,686 sat · time 2016-06-29 20:17 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23704btcintel:annotations:23704@v3 sha256:e4658cb26d50758d
confidencetrusted provider · 50
Globeransomwarepayment
subjecttransaction229baa7369…87743527f7
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK · 1,692,943 sat · time 2016-06-30 21:06 UTC · url https://ransomwhe.re/#address/1Lc7xTpPQaH8sWcZ1JpqR3daewdhPDzDdK
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_23703btcintel:annotations:23703@v3 sha256:bdd1fe1480955e2b
confidencetrusted provider · 50

Subjects132 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.