phobos | 46e1fdccfc5746e9c6ba561de9848eb36c051b6be9dc0d11dda69612ed9c6c76 | Triage

Sharing

General

Target

svchost.donotopen
Size

55KB
Sample

220808-p7dfjadbf2
MD5

95f685338ecc3926dfd2cd012f6be29e
SHA1

6c63b931c54f9c0f25aeea1d759067f5fad6c1f1
SHA256

46e1fdccfc5746e9c6ba561de9848eb36c051b6be9dc0d11dda69612ed9c6c76
SHA512

05d0dbc82e443e666eb4f293bfe54f317e7b0322de5828af1b336e58542a95e2f67d27c2b704e10a0c2e101bbbb5a6f38eb3b325f506c7e359d0bd4491f6674e

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  svchost.donotopen
- Size
  
  55KB
- MD5
  
  95f685338ecc3926dfd2cd012f6be29e
- SHA1
  
  6c63b931c54f9c0f25aeea1d759067f5fad6c1f1
- SHA256
  
  46e1fdccfc5746e9c6ba561de9848eb36c051b6be9dc0d11dda69612ed9c6c76
- SHA512
  
  05d0dbc82e443e666eb4f293bfe54f317e7b0322de5828af1b336e58542a95e2f67d27c2b704e10a0c2e101bbbb5a6f38eb3b325f506c7e359d0bd4491f6674e
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer