General
-
Target
Funny.zip
-
Size
204B
-
Sample
240921-sesxasyarc
-
MD5
78ca6400451f230898581fa40330618c
-
SHA1
e5d755d9d0475e87c1ec0c4a2d76282f5a365783
-
SHA256
0dd33d2fed9c733e035579c375fb6f7c418af4e07933e18526208669471d918d
-
SHA512
88e86944086fd9602bba8e3638344c3c822dc9518cf0c03370289764919f5dc2aa28f97c5fd9a1d1599563c44cc803298bd27e84faa82a0150c794e38f8da616
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>oIDUAVFa7ok3cvQS2zO9gJYQ5YFK9lVko/MzGvt0O0b7T8+jZIANXmhsTJs3Z+MVnfn8gBvYP2z7ZU/+RRImfDWBAjECB2N/MBmbQGZCSkxbTQGspOAyhT0Vk2RkwV6V+Y+ZAdkMGmfivVWdk2x13vhu3mjOchnB4Pnj0H1/mWu4JN97hn166rF6sbDU5qhXaOiFpinUwDXEAd0idLiw8YpwDh6Jd6troHpjlW7TU94EzYWDRT0gS0QpWRqDoaNWpwQLhUMuP26j8JsRgmzkDw48lNpJrFVEJDYm2PIm/EcM6jo1Lpo4R+qTSyYa6wqZoaqMZVLlfUMdz8yI95T/dA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>BERerpRFvNzxfnUHAAjFav98tCyyukM2TqFniFAlcKwy7AaH2CWNIo1BPBYmve9RSibsj675iNaVdIHZ1Eyn72S14iH3BQXeAno60Em9jp8XVsA47frYmyV+/YH98xGu/2MTQ4zl8e20PFXtDjKQM4dG90YE7TFtdNKtNlHS3JYbX2ACmqoRdcFrW6ezJH4WyDANRK5ln/HhrO/nkdjgcMf2xk4xiBo3Jkx/EeQcq5E5f/O7/BIHfHMujWNftouFuIgvTpbPqxGB9ziqrdK20ZaDVn0ftmmTSRtv7IymMYpFA5noEJrvlai1+29oQFNqYpd8V1kBgR7CcBOf0dEQqw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ndemseJ+lOIrWJlh1CIE+Zuqg1DhHsblWMTDqKE4/s8yncs24qHfq7XJPJVCa7s0ZFC7ne4IUROBykKW8UMxTmTfjT/51aDOvWYjfzunyTfH9CvReYGG7D3Y1kPlW76S1AI6nNJJhysPS/X4Dt+jSYQX9+FcTsWZ9BYmtbJxwyiaDRdQctYZhGRqwDsce3kqVxdb/PL13s6HygrfGIf+j+qH4V1OkD74GDcun5UDodswlI33HMEVeB98KX4IlPscDFRjxPeGJJfMnJe007yJVKJhtZxPYBuLe6JbcAtqOicmdGehauh01XymCiuW9zSJzbfEpRdWSsjhI8cXZf39eg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
Funny.zip
-
Size
204B
-
MD5
78ca6400451f230898581fa40330618c
-
SHA1
e5d755d9d0475e87c1ec0c4a2d76282f5a365783
-
SHA256
0dd33d2fed9c733e035579c375fb6f7c418af4e07933e18526208669471d918d
-
SHA512
88e86944086fd9602bba8e3638344c3c822dc9518cf0c03370289764919f5dc2aa28f97c5fd9a1d1599563c44cc803298bd27e84faa82a0150c794e38f8da616
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (897) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-