General
-
Target
https://github.com/Endermanch/MalwareDatabase/tree/master
-
Sample
240814-te5frsvhkj
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>owYxLssy/fhUJ9yNCnw7Cxx9fNZJc7wa5fnCWHoDveE7DW1exq3DCxKzUjFq9jDqavO5cmcA24OThEMaboDDJMFmvRNgOt0rsh9WKepAdKSqFSua2Fx/N9FFKvG4kdEaINsdDJggetdYvY/pd+eRIP68jW1opB6lJT+70ZcUvQzjwbMgOz3CTD1mmUnpTz9cXEzzDylq1r++9+IFeg6gSHKu8Wle9VzKTCDQCnSMgFu03RePE6SPkStHUbBfKR9jLyLxn0O2DVlB93gQbt2TsGEccq5l25000qN4M5+CzJkxa1CLnzoRqy+SIS/SM0RfICgNuJ2pNxHXJrr0AruMZg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\Common Files\microsoft shared\ClickToRun\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>h3pQXNPMY8n4T894B5XBQMDGADJ+9t4Cio3qCmakoWgBKghwZKv7OibnVQzVSJ5MeRcLGEzM/RO63q9UraV6TZLOJcirTamGlG2l+jElIpAHaU7yYaX+dSlu4Wy7LgYjccconOU9GhbW2mJ50z7li87lC+bZwWoraX/3G5gK7KSmq08CeyC7xKvnt03ww9k/V+lEjYD7I8LyAM0VfkTWpNB0eR7WdFewE8i+Le0wAds+0jeFKkwLsQ7Kcak9CNDjazLqSY6FBlm2cR7ckByBrlUVel7qFoO4B8kC1fRSYA43XDVDr1k+EExAtINpSIyU1PA8RX2pDxrzwI2slDp46g==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ePUfphwPE1ZkxalyzuDmarX0RA0altWzceYB+2MBRQN4D0GaqwVsbszRBkc3FR89M+T18/Y8aBRo8b76uASwwpKIVMjcuGXKNOusw8wDcSCHyb1oNstrPJh2iDW75xMDMmED5dZZN0Utd3ZGWKfnKdSdyARzvxsDDc5SZE1vCgP7LuLXLU5Secpq0jDn960975vAvwG8p5RGuokvzk6eizX7MKMVD4mjHsMj+1C1pBmjVhfVPTe8CNSYYWXArgb13eSg4bmYf4BRGD0Ni1SrMD+2LeV9OwpVi0TsmGyuOZ03T/lKXqGuk15eOGJtOMQ2fEjtKYGTBSGD4dXwQMeXEA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>NcvzrxXr1KIrrC/EsiJYrRnkme56W2e5DlXAuv5cieRavsqfLgoan9G4E1RmcClSg21A4xVghnJkcRfhZEtC/quk1MOAjU20UGO6Cf3YU7KH9/nWgp/KHZgmqQlEY9jYk6Nx4zIhFZ5RgSb3t0zI5ccTKbrYDaSur6xSZFdKvKn6Nsi8UpZI8/9VY+vdfj7pGxaaniJM+Uh1nCKWZlPqHK13uSCnz19Jdn+6aL3ATc1R2dchzMlwOjUrnN8zf3X39WdWo5mfqWqn+OlPA7dTVET1GrGqLvlzFf5Ti17GknyKvMn3kEFn8HPCr6vSNOIua8V9Dhj9mhiGQDb9OuHwag==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>MmGTsS7BgDeaENpo4QYMRTG1OKU/TcNsKYgPvn4+dvMfuQtkqcdDpGfLkB7jrWv8fqLc8+xtWv12UVBmgxgr/coZ2QScloSy9aZGutE/KmrfJHWAS23C8YHdRL+4YBjTQmScsiuOe1FJU+Be3w2l0ywXdDQVmgU9e8Mq7VK+8KUKdHNJLsx/58/klzpIVqp4xKlj5wzZX6yF5KTKOgcGtJxYfNVURRdTpr4lXP1eXUXFDyT4pgXiTv+Tl5wMCnroRb7gsNLvUklMoMWxNf/oHedaEcYPOWUcbsrEt/jMvtnTTJ+N+1jx4mRr3LbYSwmNU0a4Pu15g5JUXJ7xuW+NbQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>YQFlyhHxA9xiiT8Xcnvt9jFfK+ySXB9k5/GdtZejYlWpPBueGUdCGWyfvD/0enimOBauqUDmOh4R2+bvn4wpE0ts+Hy8cRmVAmVW4n1rDp7GnP+11ZRnD9+NFDaEqCXUR3qDdzfxP/9GaIM0Ya6v+TAtFMhAf65xqSqEaUmEAbXyQ6dELQ0NB7MI75N7Nwl1tuqDptvui87p+wuDfmJ+hJ2rQSkZvXKbd1GCPTEXMsOj7WvPWWj4HHSRTxUz+WTAJXJiO5So5Id/d/20DkzH3S7vTQguu2wuZg5/5PAZZFsuArOHZFt6roEDFJmzKObTk3lXmEwGJv0JaVMlgHImxQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://github.com/Endermanch/MalwareDatabase/tree/master
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Renames multiple (144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-