phobos

General

Target

Fast.exe
Size

55KB
Sample

200707-tv46kztpes
MD5

4a3762d49120264f48deb29ca8668082
SHA1

4ed52a74441ed443c09d51b625d07cded9e2ba08
SHA256

b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
SHA512

dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39

Score

10^/10

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note

All your files have been ENCRYPTED!!! Install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Write this ID in the title of your message B5E5EFE9-2797 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Extracted

Path

C:\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Write this ID in the title of your message E79A80BD-2797 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Targets

- Target
  
  Fast.exe
- Size
  
  55KB
- MD5
  
  4a3762d49120264f48deb29ca8668082
- SHA1
  
  4ed52a74441ed443c09d51b625d07cded9e2ba08
- SHA256
  
  b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
- SHA512
  
  dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Score

10^/10

phobos evasion persistence ransomware spyware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2