General
-
Target
Fantom.zip
-
Size
198KB
-
Sample
250223-c1kj2svqgl
-
MD5
3500896b86e96031cf27527cb2bbce40
-
SHA1
77ad023a9ea211fa01413ecd3033773698168a9c
-
SHA256
7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6
-
SHA512
3aaeeb40471a639619a6022d8cfc308ee5898e7ce0646b36dd21c3946feb3476b51ed8dfdf92e836d77c8e8f7214129c3283ad05c3d868e1027cb8ce8aa01884
-
SSDEEP
6144:gEXMZKhTuDA9rBNxIzdZgNbSEehM1Kq+i:gVKNuKdIzcNbxD1f+i
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>m7iZpbqfd7VABSXQFIwcuS2ujT7D/sc2urEPLpAgvBm0667zCVUm4d7BhvNJEZai2ijBeZ4PhP2o3XYiqo4BhxElZm1XBDfVouNVThDRAmKAWWoJip9XxI9CW/p+4d1/aDT5cIa//GDU61/qiZtbQxlvhEoLKrGKU3ux+DxGLdxux5B83dQVt2A0vlRO32KuWRsJVlUccCCaLZCidh3neer9I+wuL8/PL21fBtkqmWLAgyCXQSnKXuxjAsY7WYTRMFjYdDqa7xUoHIpMgG8/X8qxNnoe0oEh0osQfourfR3ugKMV6ktJG8WgEafx2Nq8/jFYG6NX9otRWsFm4RgzIg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>CaY0zCZjwZiV2ou+T7LweZVgA01Rz7CFCnNG2K9/MCgp4zPtrtXbb21pAOfT82V+gRBVwu1zRjEoTHYBLv7qehwsKD+RhM8wHSGD/wx2rIhE+ZQlZlTKA4UqlAaBV5yvS5BuTtOfH5O8BDLaGgjPfur60/oUIqsnE5x9ZUtUsvShHkglmL0cVhEDGIk5rCpzRRgL48JjnbXHto4DpKe0ZotB8+BlV9rNQSyNVWBIkeRsJiZkvrGcfF1B6WaRjzz+Tngcuedh7YnvDVuqYvfDeWKC76e1F5X8GHzN8980J6aM7pPoOsd+gqjW10WxxCPG60/ALnfZ89c6UrkYxBazfw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>Wow+3E/EITDdykQY3fy9RCRsyUlOLYoa9LRfo0AN/mSE4nmwk5MlY5K+57KDB1txdfQujR8Ftjsk4HohE5ueoaguBDEXAho83Thj1qRnCOdpSUIG4pzu3dfPdzUnE1h5ZTUh6nlIkhH/FGF67ZwLOSmecvJspc5Wy9+EvQ53NYbmL1mXBo1Y+oC2kW6H6ds0TYwaO8ifWGsHYtHR7K105VbrXhx28toQqDitkn07QfUyPytsjilhA0U/MC0N/dd+POj5/6Jm1epQLsqH8kFOJKcgx5R97p3qkoszCn4D1bs1yj3SUaxkenDDmCJZ1um9iSfEgu/HN4HkFOYtvmLffg==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
Fantom.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (1234) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-