General
-
Target
https://github.com/Endermanch/MalwareDatabase
-
Sample
240823-zxrwaawfkf
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>JJ8O9EmfTIyKg5x3k2zO/boCZNm+CrFk0BhWVPQR1GRegGs5Lg3FIorQAT5v0UY/oKr2pNDSUTBEaVT6ut2ySrYFLWX09A6YOeVXmFsj20UcladwqJ02ELHupBNayAM31i9naDjlwKI+ancjheNRYt76t1yAtTWydFvBjC/NR4TsV/s0fFfFhshpnnkabEhcD7BbYZwnkM57ev5U2GHEgVIWqnXcu6dqBjvjn9Nm8GZlcFMnbjZXTH4Rs7QUbDIaIUdhxGAdqY4lXycka0y2ry6U49CDmd/vlFTxFvTHzFiWffnP15H4Um3lFgmje1Ny+7+1iBpJII0rLaiDrpXaeQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>a4fP76PQVhrkJW9Asba5iPItRdh1FwiirJtplX4Uith899OR09tzdFslCWfaochz7IM5ft8SkqmdS6u434pcvZ6TBBP0PuiSRFe89R3RyYegzxeMjcsK42Ni+JRal2EmpnB+7FCeoYR5rp4pmVWyMjTPV7x4UnHDBW9HR4qLXY0L3uO9bi+NXik9TGcK45FGr04/wd1KhTGXxslDi/OyKnBL9188lVWZQHzbz7LJio2zmuxPxSymRsTfb4bPfHgm2+6OkLYFLClwkKi3SsQY3deq37uERG6M+S9QKB//PfrkOE2EibuvzNMyRNKtbWZJeEdKfdVhc/nDCYz1+ysx/g==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>hWuFuauorU5qJOeFfAxcaC6nhV7Mrml9D9mUTb2TlI/rSoMNdPZ06nb8pnyjbpHnzYSk46gX4PgzhaoPD7fguvx9jq9oVzXpMRWom9dxD3bNtQoFiiarSkGWxn+YWHSc2JFXIbUM8+haoSlJG/ONShgSf7ndXo3wIp9wWFqnh47xy2zNkt7vGIBXbzCK80MetKeemgSAPjbW4dwhhwgL18To2H+fRhBCIP3014NZ/Kkgj43rDrG1aeOZlU5qRsqcVGixGb9pfGr/m8D+XHFm2LSmC6HBKDLRoNc204BF686v7a6gpzRjh9g7QFLMNhLbwJaJwNADfEPMpdBFXdDomA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>eCWKujY97mTpsDSDctPoBzfSb1qknA/HKAxzlmSLP2bOOOstlObnxpO9SK7ufM/aUyMlunNuzCd7n/6vMFHVFl+ayzuymVaABuKWt+l4rXYEOm0Ko8KZSfK24Kw5RC+NKd9vW/bBEsmB+gSK7EANt9IquxzqXMBkW/UTdnNjeqwnrwKJoSOqgtfO7o/3HV3UQ7oYFhMFL8LIaML2HD+f9pcb5QRHb4Fufei2HnZRUYaQe2oKpNTz7oeYkdI5MibTSX88kEOu6T0I2rxWxvvPBeble36tUSDgOcdotSt6gSR/bT8GCdd9zp/2FG8NQfCG1FkyDxh5tvdvN5DrHuOTDg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://github.com/Endermanch/MalwareDatabase
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (1028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1