phobos

General

Target

Fast.exe
Size

55KB
Sample

200707-9ta8ak7gbn
MD5

4a3762d49120264f48deb29ca8668082
SHA1

4ed52a74441ed443c09d51b625d07cded9e2ba08
SHA256

b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
SHA512

dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39

Score

10^/10

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note

All your files have been ENCRYPTED!!! Install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, install ICQ software on your PC or mobile phone here Write to our ICQ @VIRTUALHORSE Write this ID in the title of your message You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee How to obtain Bitcoins Also you can find other places to buy Bitcoins and beginners guide here: Attention!

Targets

- Target
  
  Fast.exe
- Size
  
  55KB
- MD5
  
  4a3762d49120264f48deb29ca8668082
- SHA1
  
  4ed52a74441ed443c09d51b625d07cded9e2ba08
- SHA256
  
  b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
- SHA512
  
  dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Score

10^/10

ransomware evasion persistence phobos spyware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Deletes system backup catalog
  Ransomware often tries to delete backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run entry to start application
  persistence
- Drops desktop.ini file(s)
- Modifies service
  persistence
behavioral1 behavioral2