phobos | 2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f | Triage

Sharing

General

Target

2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f
Size

55KB
Sample

221109-gngd3secb5
MD5

14214f7904102bb6747d0e31a50c08d3
SHA1

a89974390c9c03495e631f6dca4ae54d044d0941
SHA256

2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f
SHA512

da8277a651ac3b9b7d6cef228d3a6e5b02b1eb95c93ac425dcea3610d21e4e953026c57262ec69a215c70d46b722958b8e4b747dbc1b4519a32f0e847be1295c
SSDEEP

1536:ukcgYgbig9EhjWNMSTdwp++ln/oomTc0q:uj8ijWNw++lQhc3

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f
- Size
  
  55KB
- MD5
  
  14214f7904102bb6747d0e31a50c08d3
- SHA1
  
  a89974390c9c03495e631f6dca4ae54d044d0941
- SHA256
  
  2dcaca208625860f4eb114af4c4158368284eb99c994793d5ac66d3af654bf5f
- SHA512
  
  da8277a651ac3b9b7d6cef228d3a6e5b02b1eb95c93ac425dcea3610d21e4e953026c57262ec69a215c70d46b722958b8e4b747dbc1b4519a32f0e847be1295c
- SSDEEP
  
  1536:ukcgYgbig9EhjWNMSTdwp++ln/oomTc0q:uj8ijWNw++lQhc3
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomware

behavioral2

phobosevasionpersistenceransomwarespywarestealer