fonix | e76cd9b7364d0c410f05d6fb60ee5708762ce5349149091f10bbc73aece98393

General

Target
2026-06-01_fb90e9618d8f5a304c1a91dbd3d81b2f_cobalt-strike_glassworm_icedid_njrat_stealc_vidar
Size 1.2MB
Sample260601-qaykwaez2p
SHA256 e76cd9b7364d0c410f05d6fb60ee5708762ce5349149091f10bbc73aece98393
MD5 fb90e9618d8f5a304c1a91dbd3d81b2f
SHA1 1d0659224e8b08e835474e27d611ecffd098ec76
SHA512 cc6d11c851da9082d362a71eed19729f39bf18a4204f5a5bfc064a4956852b9f4a2de67f965ba2b77de291c6b1b74c812e0bdfe94ba46ba61314a82f54f15bcd
SSDEEP 24576:C0y9PhUqkht9FXnQHR4Oo63ZhuycAbAmcKu:C02PQhzF3Qx4i/BcvmcK
TLSH
T15E456D3A6AAC51A9E0BBD13C999A8506EEB23C17437197DF22D1175E2F336D04E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\How To Decrypt Files.hta

Ransom Note

All Of Your Files Have Been Encrypted By XINOF! All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send an email to [email protected] You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. After payment we will send you the decryption tool. You have to 48 hours(2 Day) To contact or paying us After that, you have to Pay Double . in case of no answer in 6 hours email us at = [email protected] The crypter person username : farwx your SYSTEM ID is : 95339A13 Attention! DO NOT pay any money before decrypting the test files. DO NOT trust any intermediary. they wont help you and you may be victim of scam. just email us , we help you in any steps. DO NOT reply to other emails. ONLY this two emails can help you. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. What is our decryption guarantee? Before paying you can send us up to for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) You only have LIMITED time to get back your files! if timer runs out and you dont pay us , all of files will be DELETED and yuor hard disk will be seriously DAMAGED. you will lose some of your data on day 2 in the timer. you can buy more time for pay. Just email us . THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) Regards-FonixTeam

Emails

Extracted

Path

C:\ProgramData\How To Decrypt Files.hta

Ransom Note

All Of Your Files Have Been Encrypted By XINOF! All your files have been encrypted due to a security problem with your PC. If you want to restore them, please send an email to [email protected] You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. After payment we will send you the decryption tool. You have to 48 hours(2 Day) To contact or paying us After that, you have to Pay Double . in case of no answer in 6 hours email us at = [email protected] The crypter person username : farwx your SYSTEM ID is : B52B1B63 Attention! DO NOT pay any money before decrypting the test files. DO NOT trust any intermediary. they wont help you and you may be victim of scam. just email us , we help you in any steps. DO NOT reply to other emails. ONLY this two emails can help you. Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. What is our decryption guarantee? Before paying you can send us up to for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) You only have LIMITED time to get back your files! if timer runs out and you dont pay us , all of files will be DELETED and yuor hard disk will be seriously DAMAGED. you will lose some of your data on day 2 in the timer. you can buy more time for pay. Just email us . THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) Regards-FonixTeam

Emails

Targets

- Target
  2026-06-01_fb90e9618d8f5a304c1a91dbd3d81b2f_cobalt-strike_glassworm_icedid_njrat_stealc_vidar
- Size 1.2MB
- SHA256 e76cd9b7364d0c410f05d6fb60ee5708762ce5349149091f10bbc73aece98393
- MD5 fb90e9618d8f5a304c1a91dbd3d81b2f
- SHA1 1d0659224e8b08e835474e27d611ecffd098ec76
- SHA512 cc6d11c851da9082d362a71eed19729f39bf18a4204f5a5bfc064a4956852b9f4a2de67f965ba2b77de291c6b1b74c812e0bdfe94ba46ba61314a82f54f15bcd
- SSDEEP 24576:C0y9PhUqkht9FXnQHR4Oo63ZhuycAbAmcKu:C02PQhzF3Qx4i/BcvmcK
- TLSH
  T15E456D3A6AAC51A9E0BBD13C999A8506EEB23C17437197DF22D1175E2F336D04E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution fonix persistence ransomware trojan
- Detects FONIX Ransomware
- Family: FONIX
  FONIX is a Windows ransomware written in C++.
  ransomware fonix
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Detects command variations typically used by ransomware
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Renames multiple (11448) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Disables Task Manager via registry modification
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2