General
-
Target
https://meltedglacier.itch.io/lovedoll-toy-factory
-
Sample
250117-qe7pcazlbj
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ni1PASutFg91jUM2kpKKROviaTaB4q0KUPRXyNc6DBQwf7GNOgDARZ9ZckrAWW6jN4wwibliZPvvbfuxpRiuctWWKtqaL3SBVmECAvITc0MUG7ixgx0hqqskSRK4c1Cw4RbFQxzL+gC7i2vJhtTNXYoK7g+i476XOg4AygvABrs7Gf8ofupoHVMh1V3anpmaIS9lzikBaCtL4i/MQlSFbz2GICeMNXmfcxQ2TrkBVAeRvy8CVkPVjKQ5j1//EjaODZl7PC6YTmQ9M/pyA5PysdURZZCQmmXsfLXxaqZUgRSDXnIjqJL0o3KeYcsL2+JG7kx+i3epYq2tgfkYQ6vAqg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>TBT9oYAEeB7JqXlpIAI7LzwzJQ6Y+dblQi7SyXQwDl49HuTKS4fWGNM+yD1CRPA/oKiIJFLG6pk+JHnKyP0qZnBv1y5Jt75jsGtfXKOcotUzzq1cAnoAUMVwHZ/pjJ3e6GCo+Jtjy0CYsqkb9T0hOhEx8zdQQA54Uz9BRjlsKjBL9wZC7ZehwtDN0JMlhRxqLS5KU0eIhWW65RZLRR16l8uhm75dgOP+c5on/eToUnoRdQDvGaLibVgzDu4eTuKWxCCERd3WgFz1VVnLrrocugKQzXNGkeBCcDRGUnV32/CceeuOlKOKgbAM4uqqDFhcPFsbJbc0CdLLlg8gEluGZQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>l2vQ04VlAxeGo9S4jxFX8jKSrpFNQ29QvYymSWIjcrXf1iDLzpMLHkxPPg6q7axxgVD0RqtPlWza1J2pmRzUhhuFDG8Cp+WUzLCLRNU3C+Y6haMgbMDf/oXHK6fmq5vZ8utaKlv/yzb5LjIjqn65EguTdXQ9Ag75xp/kwfRIvNPJQhB7O7kLzQJFRjOhJQelaD624N0PCAkVK0obD6VdGwhPofNoHfaFFbbp7wpdjTGEDhJOt8KZeJrhLtneFdWqwuIXOzQ2oF3pYkwXh//KWPuQL8Cb5DjS5VoH1lXZIkvAvPKaz2F33dU3Bnz70CgMWXyxy94Z4RVRmhCyvBT4+g==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://meltedglacier.itch.io/lovedoll-toy-factory
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (1027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-