Resubmissions
10-12-2024 08:15
241210-j53pravqar 10General
-
Target
https://github.com/fabrimagic72/malware-samples
-
Sample
241210-j53pravqar
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>hK+GKssqCQSgssHv48A0nlwSYQ3+twsXL1/AWHGHEpZjl5tjgtyc9uDYs6vOZFW3177uYAtuxZSDVSN6Tab9ZZCwfKdu4qhY+kBuy3F080Il30U5k2Z4G2Xjt7/pDiCnIMIbh8kG9jIqf2yDbh0bQsF0izchpEb1SQXYJMHkDPNp+KiLlECpDGK2rFNX4oeGhbNFdpFRlxBDDgKqBgdk4qroMZDVQ1Aq+6m8BE/H+oIyStSDjuCX0aVtpkTU/SlCS4hpUd7MxPOhPW43z1Me1lfACx6SXxf8aH0lkOoYwE6kaK45v4kgC9FdHvfuA+8tzTX9NVl6nynU7a51/wG2eg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>l0SJBXGfwetEpaeodLAVBNCESPuqyOaWS4SFXkosfD/XcLgFm+flJkSC3duHFJBCqnG5eiSiPWw2Mu5WVYKpZW0Vgv00ahPZH1FvULC6FNAy10gm6JwpMRlA6z4lmNS2ZUcvCRs7+Z+h0jXIDQscpEZOYKYYIovAS3NajvGUxmz+vMPK1vIQBFyFySnMo5O8MTwmGguL9vfyJquCJEkImhvOfi7V79+veUgmtdmudviQIdVUA5If9J89mXjsMDEl2e5SJARTL/05i8ZVbOs/VKLYMal4Y9yXBmVE4jdTMyWlgSWL/HIEsJq2yarWzduBu5oCebTI1pXRnAGSHSzwlg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>kp9OrMO2Y8Wyjf8Unorkh3MMonJLq1VX3b5Z2crcK3d+P2KfE/p0GTEDrSwMWrYmGugMtvhdFi+SaNxGe+YY0nO/6eRUyOq2cqs8Xjr/5f6a9mqJJPpFeaf9q4Iccl7SOEpbWT0dPeZpQdd8oaIBdipCgPIyneAyqksLFpMlZ1mhAGlYcq4MvsiM27QNBAAYg1PX+YOU46ZKvxoJVr0SqDbO3eanjT6w7VeW+B0Rv+NRC6kFPPo/ENfxXvOZu1IrzokvMj3ojyoEAgHopAtDEo5aNVrTGKNCx+I9aSW7tFq4YDubT36SRotTOBSG45CqS3c343t4XToYCve+5X8qJw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>Sfy00ZQozxvdlPcyqXE3pQEg8it5j0mslDgscQnVrWD+keraZpWv+eARhKkL2h8lFW/H3Z3SrhmszLO1CGPEYW6t+gAIOI8+P+ZYKorLSIeJmnyYPg74AaOiI2U0Ut50OXH5+CaUnN9myfdjLY3qWCM/lAHj+212lkruNJR1tVpxRMR6Uw2vV9iO+i4yPuO/0yQ8BJHvnf37nC4LLnGXFoeSZjokuSX7prOwnVnd8CI6J/8inpESed4qDcgmtHeZcaSTYlJbNaMh3LBWjx8bwrhdxXRiJjqgJzwV/Bx5PoUtcNzkvIg13XAqjBUTbzZToCLV5AhKUKjBhi5k2wijmA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://github.com/fabrimagic72/malware-samples
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (1029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-