fantom

Resubmissions

17-03-2024 17:57

240317-wj2a1sce3z 10

17-03-2024 17:45

240317-wbpx1scc3s 10

Sharing

Copy URL

Twitter E-mail

General

Target

loader.exe
Size

182KB
Sample

240317-wbpx1scc3s
MD5

d5c0f4aaeda7fe68e2ecbf1f11760934
SHA1

78848153f67e18cecf70dbf514162851949ae13e
SHA256

cd914eaa47f3d00baa5f5cdee725baab2f7203403e12b2b624d5b4459254f7d4
SHA512

d37e2f23ddbe5b5af04d08a375fcae1677a00a07a3ceb88fb6f85b419da769908d75e8796b994b7bc2e6aa6354135c4678a2c28b6a4060840acd4dd7df9b829e
SSDEEP

3072:Rjc+GeTJtZD2j39iF+pEh61cI0UicdjLp/XoXUW6zveOWSNgEP:RTpA39iAl1d09cdpXoXh0eOzgE

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>azK3jW6Xq/TUHWaYv18nWA9wes7yxuzz9ZvCzyMGF2xvBwHyvnso4ThGU7Ym3EB/yiC9MZn74QVO6U4GVVdpqkj3skYAbL6QfNtJWM76nkHZ6nzZMzss3W4B8o6XZKx7aRZ3iyJwZwmEhA6xieTvI2BLluQL/aW22h8j2URIrWbuqStbsyRe0txxi8PtY7msapJyHxmM4qirChn2CoNSR9xcdLn7zRUTRk0EoZfoy9Dhs7SejbJeYpQOUIUvIMnUwbbH10F/DXQBH6f0vJLbATVeILXZBOe7+vnmkVpHZWo2j/vkxdZAdek0C0adZ6IgbhE63g5ClCcyZPpvLryLbQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Targets

- Target
  
  loader.exe
- Size
  
  182KB
- MD5
  
  d5c0f4aaeda7fe68e2ecbf1f11760934
- SHA1
  
  78848153f67e18cecf70dbf514162851949ae13e
- SHA256
  
  cd914eaa47f3d00baa5f5cdee725baab2f7203403e12b2b624d5b4459254f7d4
- SHA512
  
  d37e2f23ddbe5b5af04d08a375fcae1677a00a07a3ceb88fb6f85b419da769908d75e8796b994b7bc2e6aa6354135c4678a2c28b6a4060840acd4dd7df9b829e
- SSDEEP
  
  3072:Rjc+GeTJtZD2j39iF+pEh61cI0UicdjLp/XoXUW6zveOWSNgEP:RTpA39iAl1d09cdpXoXh0eOzgE
Score

10^/10

fantom evasion ransomware
- Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- Renames multiple (3768) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

10^/10

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Renames multiple (3768) files with added filename extension

Disables Task Manager via registry modification

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2