fantom

General

Target

Fantom.zip
Size

198KB
Sample

231021-hek7cadc5v
MD5

3500896b86e96031cf27527cb2bbce40
SHA1

77ad023a9ea211fa01413ecd3033773698168a9c
SHA256

7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6
SHA512

3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884
SSDEEP

6144:gEXMZKhTuDA9rBNxIzdZgNbSEehM1Kq+i:gVKNuKdIzcNbxD1f+i

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>lFPRfStM+mKvdw+IQJ4GWWXwhsWt5EzrG8nx6Oiq8uq8EM0SUdeilZiyAuGG7Q3REG6JG5PxPlhnS+fjFou0z7hrgU3223AUavCL3yMiIZ1AWr5fEEkbRHzWWvQN3rNRX32cB6SoUTmUB7USlHdt9Sl5L63CXIX+wf6lQ3rPGReMihOhqht14c8qfIJcCrI/nUsriKnDSPWBknEVd5DjocE/6wqpS1gqewVBAnLYnLKR+F/nnQLk/Rl3QeJjbyl7hfEE37iV+HzK3H+52sqMR2t04zsiv9pt2ubOXA8w5scH8Th+vjN3R6zZd1Z2PQ7ksE42utdq28N/tSm5ryBvog==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\DECRYPT_YOUR_FILES.HTML

Ransom Note

Attention ! All your files have been encrypted. Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets. That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us. Getting a decryption of your files is - SIMPLY task. That all what you need: 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] 2. For test, decrypt 2 small files, to be sure that we can decrypt you files. 3. Pay our services. 4. GET software with passwords for decrypt you files. 5. Make measures to prevent this type situations again. IMPORTANT(1) Do not try restore files without our help, this is useless, and can destroy you data permanetly. IMPORTANT(2) We Cant hold you decryption passwords forever. ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. Your ID_KEY: lFPRfStM+mKvdw+IQJ4GWWXwhsWt5EzrG8nx6Oiq8uq8EM0SUdeilZiyAuGG7Q3REG6JG5PxPlhnS+fjFou0z7hrgU3223AUavCL3yMiIZ1AWr5fEEkbRHzWWvQN3rNRX32cB6SoUTmUB7USlHdt9Sl5L63CXIX+wf6lQ3rPGReMihOhqht14c8qfIJcCrI/nUsriKnDSPWBknEVd5DjocE/6wqpS1gqewVBAnLYnLKR+F/nnQLk/Rl3QeJjbyl7hfEE37iV+HzK3H+52sqMR2t04zsiv9pt2ubOXA8w5scH8Th+vjN3R6zZd1Z2PQ7ksE42utdq28N/tSm5ryBvog==ZW4tVVM=

Emails

[email protected]

Targets

- Target
  
  Fantom.exe
- Size
  
  261KB
- MD5
  
  7d80230df68ccba871815d68f016c282
- SHA1
  
  e10874c6108a26ceedfc84f50881824462b5b6b6
- SHA256
  
  f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
- SHA512
  
  64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
- SSDEEP
  
  3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Score

10^/10

fantom evasion ransomware spyware stealer
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- Renames multiple (4930) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1