fantom

General

Target
Fantom.exe
Size 261KB
Sample251104-c25llsat9c
SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
MD5 7d80230df68ccba871815d68f016c282
SHA1 e10874c6108a26ceedfc84f50881824462b5b6b6
SHA512 64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP 3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>j20s/32xBVPwHaDsn95LsT6WgThP6QacjCpWuskX58E12YOq39kyP+2f7gz1pk4OTlTLDVUFurC5lna097ojGbJ8CnpD3Qb+xWpQTGU9MK8se03wewM2RNALDotaM+fjQj8ZGrNPJQFV8al6B5TUB4/eKgnabAHeIP335P/MpGsj3XUIn44khccFmiROkeOu1Ne6na0jNuVhrpY+oqZolwMySMwR+OgkqArdFjVgrXFkuIhezGzJCNCw2N0kZa3FE05smqw6smFlmjWe2zf3UsEHL2M0Iwqln1z0FjQ252ViHGFx7Q9zqr1Jc7w0AD7YcxaUbRQqgYKdKElTzXw21A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>LEO595g488cksUnLbPEAIbqJLhs42Bcyya95D0+cGLDGUfSpMNVZ+bwDgROxHdpUtrSNx0H2YN8qGtttuzACjzUUwvfl83BKsaDGJqKF6gmBMiN92AUai+TsZ6wnpsaOIjuiQwZiLp7ngnTo4+5gBSxZ+wJRkATV45mLE/zKQnbpfgcDalawTTSafAbV6L7jp5VWOBLCrKRp4fopfFAROJrdG5k7lM0RJBCEJpWplc5OxvD4iwBufSohJPB/1sEJHa83eR+WwOemU+RTmzdCKP1s5wRy/BaDGRnuwJGjm4o84QdXN4JMMwYjMBO0rLrB367uF8KeFNp5e92d9cYQZw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

Extracted

Path

C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>be0mdfuF2uHb/Y9wYJprFsUng/Av1LD9RuMqgsfmJvtHLzlGuLJDAp5fFX1JSGTYkVwaq9UU8js7JIPkEQpPZ8jHKp+OG6xJIQ2a9uCXzLOj8u5zPr0O/mcmWNGgQvLcwIRpYlwZKmALTz7vQyTYpo6aKUl2HaOc+01iXR2iYUBToLJLyeRbQaqTh15dpr31dL5XH5qWqlGMvsYthqaSVnQPiH0oiYjpWghQT0wFZhMVZyN19eiI/qRirxlFre0EpzsBFiyzRM560a7NYbhe+CTT1A+PmUhVi9WhUCuobHhMlGuuQoQKloTIZeS7d1yN+hE+qNdq8CEJsFRBeK0e/g==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

Targets

- Target
  Fantom.exe
- Size 261KB
- SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
- MD5 7d80230df68ccba871815d68f016c282
- SHA1 e10874c6108a26ceedfc84f50881824462b5b6b6
- SHA512 64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
- SSDEEP 3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery fantom ransomware spyware stealer adware persistence privilege_escalation
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- Fantom family
  fantom
- Renames multiple (5465) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3