Babadeda

Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

Babadeda Crypter

Phobos

Phobos ransomware appeared at the beginning of 2019.

Suspicious use of NtCreateUserProcessOtherParentProcess

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Executes dropped EXE

Modifies Windows Firewall