General

  • Target

    97cb4bf23ebc72c97f8216182eb44f9bd45f3f7fff0d1ef9c573e7df79956ddb.sample

  • Size

    192KB

  • Sample

    210726-386gy5xqax

  • MD5

    eb5d46bf72a013bfc7c018169eb1739b

  • SHA1

    f55680a34521ef07c2b8dedd1b74a9927990485a

  • SHA256

    97cb4bf23ebc72c97f8216182eb44f9bd45f3f7fff0d1ef9c573e7df79956ddb

  • SHA512

    b3e2d512c95913fe0ea1732f1e0bea2e849eb2ef98046380b01c76e6ec38a2ad5c00dcb66f90ad1f9d9c3ab97b81cd92318bdbfc84e2d408ed577902511b0c54

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note
Your computer is infected with a virus. Files are locked* but not corrupted. Send an email funnyredfox@aol.com and you will definitely be helped to recover. *you can send us a couple of files and we will return the restored ones to prove that only we can do it IMPORTANT: 1. the infection was due to vulnerabilities in your software 2. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. only communication through our email can guarantee file recovery for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. if we do not respond to you within 24 hours, send a message to the email redfoxfunny@aol.com 5. our goal is to return your data, but if you do not contact us, we will not succeed
Emails

funnyredfox@aol.com

redfoxfunny@aol.com

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
Files are locked* but not corrupted Your computer is infected with a virus. Files are locked* but not corrupted. Send an email funnyredfox@aol.com , specify in the subject unique identifier 65412767-2408 and you will definitely be helped to recover. *you can send us a couple of files and we will return the restored ones to prove that only we can do it IMPORTANT: 1. the infection was due to vulnerabilities in your software 2. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. only communication through our email can guarantee file recovery for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. if we do not respond to you within 24 hours, send a message to the email redfoxfunny@aol.com 5. our goal is to return your data, but if you do not contact us, we will not succeed
Emails

funnyredfox@aol.com

redfoxfunny@aol.com

Targets

    • Target

      97cb4bf23ebc72c97f8216182eb44f9bd45f3f7fff0d1ef9c573e7df79956ddb.sample

    • Size

      192KB

    • MD5

      eb5d46bf72a013bfc7c018169eb1739b

    • SHA1

      f55680a34521ef07c2b8dedd1b74a9927990485a

    • SHA256

      97cb4bf23ebc72c97f8216182eb44f9bd45f3f7fff0d1ef9c573e7df79956ddb

    • SHA512

      b3e2d512c95913fe0ea1732f1e0bea2e849eb2ef98046380b01c76e6ec38a2ad5c00dcb66f90ad1f9d9c3ab97b81cd92318bdbfc84e2d408ed577902511b0c54

    • Phobos

      Phobos ransomware appeared at the beginning of 2019.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks