General
-
Target
https://github.com/Endermanch/MalwareDatabase/blob/master/jokes/
-
Sample
240811-lsk1aaycpa
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ojJrNA+UVXui30irIcbjxh2ZXi7r2LBb9ivUs5JFkIOElAcv3O25FGlI9CmSavwq+v4UF204NlX+DW+NiFgzGyItLzA1FFxTm76Ted1RiM2VKKh8TwOnNwVe1gzVlqfrPEFwCgA7q2PiWkiMweE2KVjgxsCNQH8fEtUuLPlsrW+spMgHYKgz7yiRmTLltus5IYLW+iglRb5OIRwIOtfPcwZRLmTz2oCYwS3QHsgNEfN8Jj2yam48TvXMoOhZRmX0uKzz1PuHQFZ9frs6UmPqHLM2ZkqwM/O+A1VSs9mJzoVNoCyE3gHSQG6fnbZ56vd/jFpJrv7jGTUtWuyilIHHOQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>KNz0t80mlldz1O/QScWb+i/Ox/XlPorlLYhCJTRsAyfvVmIbx2fUx4lvsIdPjzz1KDlxYL8rh+C4bPHzoU/VOxCerHy1/5GFZ7gxjCpiX/W75WC7tiY5TTIIbSdQDVP0yAmEAhHOggTFuseGU9TAJ0aN+46pu9DegpbQBYiTAfbFRktJ0kNvuCuW7p4ZFaRSao0YQlRVM/X4XRpWj7WlxXhoxLxXltTWaNzJOIHz8WvqtP8Wz7kHEsCNQqDI/df/3VfH7I65yAovYz92qFOkVtNBJRZnztHRn3O7HUqz3ylT8Y4kEhYWKvM7DV1bofKCetT12Da4XLXK5WhmhTtMWA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>gnffoBB0azxcIxyVd2SC1Jgolvt9xSZHkd2MA+vZ2g3wVQ0RWvsRoU+obJTdD84uCeh25sfjOmrmWomTY5w4zLjyiwqw7PMAKcRzw63349ha9LPApiIT+2dd8ld6yTTYOzs5bt2tp2zYQeGVyCn3KlXZI1HOya4pzsBomU85Uo1LAdB6m02l3NZlOJxnGNdtJeUssmJZdecSWfdYv3O9WQ+eDhBJpqwdkMZ9wAP8TNNHNCi8hujDMUpxn0PWF1SXL+K2TnCL04rBvzMih2U0dwgarljzKK9if3PE+lqB/68MMlYs4K81XyHP15GB34erbQSLGjRTn7zdFyiohYiOqg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://github.com/Endermanch/MalwareDatabase/blob/master/jokes/
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (5243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-