General
-
Target
https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/Fantom.zip
-
Sample
250326-1t158atvax
Score
10/10
Malware Config
Extracted
Path
C:\PerfLogs\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>CoAQmWvZsUPy5sH4cFiQmbtqT2TVLXeIafDWlYqDXlGEwd8s45diRTElb9UvoEXP++6rL5dEbujYJ7X8VxrJcN5m4aE3o5CEFJNoJEixcncH0ROWLcgFZ8L8omwC/lH8yj+P+2Hlha3K6Bx3A8HdcYNR58E0NkJKbDFUe4BKERMKokpFPB70FvcJhqkvBn2Zivt3UtvxUSUuSCzzR7igdC0Gud5oiEbjWdBidnhEmVMJqgdRMRcwtRYuQmkQI669riyxpWBgMkw0G8bEhSQkQHmrSO6Om/UcNxEgIo24DbPI/9IxtPNgZc8I7Eaqaa7OTfbTfI4gl+pinuSYv3PauA==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\PerfLogs\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>efVk5wMXyNQa7yo3EhsLuaHNSMwCERKvY4OBA64tUIQ6/qgWNQBa/Hm7CX8kDdFzmhlmV27uiHx6qOhssAKoz45rN/4GILdYG2faY2gB5gPJTFbD5pF8gMyQgAzJm7EeOLBc5PzOOmAcdXwnA2cPU5U/a3uyayv7Inu/TnFld/pxIxLJYw8UQG5bCzGdN/1G6WEdbwlGkHercl1T2XTmhtGjxi5e2mBhmfEkHGN+vD6nb1uB5rCCnK7T9IJDw89b/Qq9tSqTJ3774u8ij20kP6oPj01nw6F92t1WdNYvceWLT9oYHirEikHtq62nufi8AV5RteM33dR/fQL0Vgrbgw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\PerfLogs\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>A/ZVl7qKV75p7pAD87J9gAipWwTSYIMFUZwscUHSsrx02gAO67zvQJEeP0NEKbEEiIQlNT9iu3oyXtOrvVEPnLOdHoCmbHo6ZDRmWLtVGKDX1r/4vE1Rt1rKtp+eZBAI/1lX/+qSnKH/KYC4FukB1zAsg3DbFy/Vxn01qEIzd/fo7xCC5wqKsKvarjSXuocdNQwl9iMW30bM0l1UDgULeSRZy8ak/YOLkz8ax/rDs56idZwApR2LNH6TnQbS23nN3hzKTSdjdbHZkz5kGDpItIRXJMGlQQUd1IjRTmS5hzXfNdqG3jaKVun09AGGDn2D4FbUaN9CRNq/ehAuQDW4vQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Extracted
Path
C:\PerfLogs\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>ZPvQvM8SfaOarNBJbWnXZ20OLY5YfpQ1cyfEI8URo/6dqUNPs4kP56tJ6r7BeDv6h4dRKWb9tkQQPFBX4DHf1/Znyn/zaDytJCtsHlsk8NmwRp8KCp+ouvSi56aRFmU77NUFISpju/trgS0+JmD+uN+Az2RTZVyHW7x5tyzO0mTD7mbAsQ93OIlU/DRdOPsBOhsCDFIQKpH003meX4CUpzs3D+SYidhRIwuhoCaDf+DMcarVfLJLyvrs1VpJB2X4GT4G1B7e/fzyu4ymKIT/5AeoNbobymJ0SL3Iyu53rn2Daa0h1oL4XaX7zqrVvo9pbZZheeipvhmr/EUUWjrtCw==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Targets
-
-
Target
https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/Fantom.zip
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (1012) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-