fantom

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>ARoMyHdZnq1e4SfUGoj5KaDPOPeJO92TprPs0KT/nft4QrDSaFHfyTaxVCnR7o8W3hpX0UAOGPajuHUzvm+7GnRPuW06oIi6/Eq/Zjd50F3o+i3KjaCpGcvuSpmQm/i/wG/wfAA8KU3GlLrOKN/qv8lSKaqXbJdCch7W62aqBXIoT6yLQFrildMbYTqA02qGwSDq/befp5PO7rLJ4edl7PDjqgSKyyiYxH8gCnSfXKY/58wfWoWdxeaP29fj08zNwEPk70ACoVOI6NZCFWjb5UmhDJgoB6FK1jayK1/3wxx3thpSQ17D75dngv1dFiiwvrtUQbPD7Z8PPI2nwVY1Hg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

Targets

- Target
  https://github.com/Endermanch/MalwareDatabase
Score

10^/10

fantom infinitylock discovery evasion ransomware upx
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Renames multiple (1018) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

InfinityLock Ransomware

Renames multiple (1018) files with added filename extension

Disables Task Manager via registry modification

Checks computer location settings

Drops startup file

Executes dropped EXE

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1