General
-
Target
http://Google.com
-
Sample
240418-yd4v3ada66
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox fantomd12@yandex.ru or fantom12@techemail.com </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>X6TJcS0/I1+HlQv1j9jpKUzfLP+1VBhh8h/vZVDmwUaoTlZ7ugKS571rMgm8Kw1Zpeh1zseXbDXaa8c1KewCECE7fUDwOnwtRN5uHkgMdnaeOR4LFrQip37JJ+YMpAqG2PEhHm9QhcITy0xBGH8s7wD5Yuv+T0jx64zFBU8Q5R8ZY2RfUtxUgxJq0elxbHI7k7/hHzDhMFPaZYDeVFsdlal4/LP42l7jPzQ7mkbZobXaYHJRbuhEBW6/yi25idpdOivx2fplwX39O2WmS4iJfe8/PEDUyEch8q6X6zfQJqLXCoRh1XutOdvW8+2FHqZciBOryj+W1g6Aefjs0PCX5w==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Emails
fantomd12@yandex.ru
fantom12@techemail.com
Extracted
Path
F:\Readme.txt
Ransom Note
Oops! Your files have been encrypted.
If you see this text, your files are no longer accessible.
You might have been looking for a way to recover your files.
Don't waste your time. No one will be able to recover them without our
decryption service.
We guarantee that you can recover all your files safely. All you
need to do is submit the payment and get the decryption password.
Visit our web service at caforssztxqzf2nm.onion
Your personal installation key#2:
ZgCbRQCfPuLpzodVk9y0IxKI3zlNZXr+27hNiIdnkDtBPL3FDAbktJHXkmWBZOaV
PHgP1GxideIpdOm8I5R6alHLNP8kzJdT0hSn4p2+rRtMs5GvPCCKT1dQcF6D72Qb
/c0l6Wu6MmPHWQqtrteiy/aiAlTCvArEOSsBGFKuwah8leyw2w2lv32piF8hMw03
5Ws/v43jGC75yJBMNISOEyMu1XaZTPO8LIOa7ep3NCkNqXjLXBdn2Qc0jVkv49wR
MqWj7jOjW6yRMoA3Vj5UlNGFoB79vInIjc5Q53ia8YkfAHSJbk+6ZOUwIKR7rFQD
3yq2aSSnA5fObNp/BEn94ParZUabKM5k1Q==
URLs
http://caforssztxqzf2nm.onion
Targets
-
-
Target
http://Google.com
Score10/10-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (4624) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
mimikatz is an open source tool to dump credentials on Windows
-
Blocklisted process makes network request
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Drops startup file
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-