fantom

General

Target

1181-rocketleague-diamond.png
Size

42KB
Sample

240830-m79sma1bpa
MD5

b14977b21ce0539b31fa537bcc3dcebb
SHA1

1c5f82620d563fdaa9eccd2edd9b7bd18acd12ba
SHA256

5266c70938cc76a1c165e3bc2fdfc14d1a1812be8b52b37386115108f0cf6f2f
SHA512

caf214c9919f651a0369764172877101f59209cccb6aa37c2a8f9e55eb78217bf5f85fb529c7911eeeda429ff78f58821ffe3448d2a71ad6d3c2b30b07e17dc1
SSDEEP

768:cuP1AbDRPBSKYAiIptXtzr+78zV2gCd2vxmr5+FTK/4lfA4/fK6l6KsFVf2SZPC9:cuP6tBSWiIptX5r+ozV2gCp4fjll6Rmb

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>EPY2RJvmXoXfsozXF64BSBbW7bCMH9aDHdcm9VpUBnYS0KczgM2qRTl6BUpNnhbW/s9LvksQcr9mtX81xEZCjlp2D4qBIb/WqslAdDBRKBZzsRVszFRyxaLIRTj4T7RelZudbFC9wPrl6buK/PZxaKESDWZ+LItRWpBDYQq+51nfoGKzHJVsNVIuz7Em3Z74b06eCcg3ytmlXDJ6+eWNoRzwn0rMYaQSdzu7sc5bnHhYlZ5lXcyQ2EEL9rfpfyQh5RXsPIIqbhu4iJA0uz8mOJvw06dj17T0q3AExsQI6naULLFzsugvEuDvM2oFl4oigNth6NeN070oYQ415E3rLA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Targets

- Target
  
  1181-rocketleague-diamond.png
- Size
  
  42KB
- MD5
  
  b14977b21ce0539b31fa537bcc3dcebb
- SHA1
  
  1c5f82620d563fdaa9eccd2edd9b7bd18acd12ba
- SHA256
  
  5266c70938cc76a1c165e3bc2fdfc14d1a1812be8b52b37386115108f0cf6f2f
- SHA512
  
  caf214c9919f651a0369764172877101f59209cccb6aa37c2a8f9e55eb78217bf5f85fb529c7911eeeda429ff78f58821ffe3448d2a71ad6d3c2b30b07e17dc1
- SSDEEP
  
  768:cuP1AbDRPBSKYAiIptXtzr+78zV2gCd2vxmr5+FTK/4lfA4/fK6l6KsFVf2SZPC9:cuP6tBSWiIptX5r+ozV2gCp4fjll6Rmb
Score

10^/10

fantom infinitylock troldesh defense_evasion discovery evasion lateral_movement persistence privilege_escalation ransomware spyware stealer trojan upx
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- InfinityLock Ransomware
  Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
  ransomware infinitylock
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Remote Service Session Hijacking: RDP Hijacking
  Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
  lateral_movement
- Renames multiple (1029) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Password Policy Discovery
  Attempt to access detailed information about the password policy used within an enterprise network.
  discovery
- Hide Artifacts: Hidden Users
  defense_evasion
- Probable phishing domain
- Sets desktop wallpaper using registry
  ransomware
behavioral1