fantom

General

Target

Fantom.zip
Size

198KB
Sample

230331-3npw4sfg6v
MD5

3500896b86e96031cf27527cb2bbce40
SHA1

77ad023a9ea211fa01413ecd3033773698168a9c
SHA256

7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6
SHA512

3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884
SSDEEP

6144:gEXMZKhTuDA9rBNxIzdZgNbSEehM1Kq+i:gVKNuKdIzcNbxD1f+i

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>BlxSydM3/mw8hQS2FuckfwK+hqdxuJByTjGuW6Pkbs3xudV6ONB2KKTM/5pIdsciDfbJmhfbvFpCGsYFMD1FW2Cvgkz0F8jMZGNQtBuTPzVdHR3pyhlt4cZo7do2B8/Mzd4tv24l321YikciyFHVRJpQwC7pc4EIg4kHiPPT010rVRhkyNF8NyABUKMvY4MnJJa8qhKw8ExEVZ7jl2KOMT5aBNaadn9qA4Xjj0aLiR/hAQ9WJ/7hB99g15mE168s/hrL6GIKLXynXL1rhlyRP0DY2nL8IurcaB4ogtIV/M7AFDMXEJwrByyeQRa7k+lzIJKPqBhLGzAPNYWXwhkw1w==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\DECRYPT_YOUR_FILES.HTML

Ransom Note

Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: N66DqyIX1K3oJFOLQSD2Ey5C9Yb95Hbgnz65Xj0+Y4NzMIblSBAkFT786A6+A46nojKvX1nD2tgE7oC/ubkeGWUDUY6Tt6W0BhiH26xlxLTQddv9ckDf6r5BSv6gLoMPAL53MMnNOv2Xgz6S4495zkoN4JCVKx92i3CJi8n4dGwZURllZCZrPi0Sa3I0isQTRr3zOMx7UC6WgNlkcd2cRNqFTnpXNpb9OpaeBYhBOlNEi7/K7qOLHZqQQc7HnQvnRURo+ybBcs8b6bGtSj38+PbABI+3Yg+ocIwDlbLFiCkBrm4GfgZ+4WQTaVfFNaOOiFfNwAwVyKn6ju0wpCiWoA==ZW4tVVM=

Emails

[email protected]

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>N66DqyIX1K3oJFOLQSD2Ey5C9Yb95Hbgnz65Xj0+Y4NzMIblSBAkFT786A6+A46nojKvX1nD2tgE7oC/ubkeGWUDUY6Tt6W0BhiH26xlxLTQddv9ckDf6r5BSv6gLoMPAL53MMnNOv2Xgz6S4495zkoN4JCVKx92i3CJi8n4dGwZURllZCZrPi0Sa3I0isQTRr3zOMx7UC6WgNlkcd2cRNqFTnpXNpb9OpaeBYhBOlNEi7/K7qOLHZqQQc7HnQvnRURo+ybBcs8b6bGtSj38+PbABI+3Yg+ocIwDlbLFiCkBrm4GfgZ+4WQTaVfFNaOOiFfNwAwVyKn6ju0wpCiWoA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Targets

- Target
  
  Fantom.zip
- Size
  
  198KB
- MD5
  
  3500896b86e96031cf27527cb2bbce40
- SHA1
  
  77ad023a9ea211fa01413ecd3033773698168a9c
- SHA256
  
  7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6
- SHA512
  
  3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884
- SSDEEP
  
  6144:gEXMZKhTuDA9rBNxIzdZgNbSEehM1Kq+i:gVKNuKdIzcNbxD1f+i
Score

10^/10

fantom evasion ransomware
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1