phobos | a07410f5b618fd091c0ad7db523b3c2f365bc5a762303cf3ae9280b985196ced | Triage

Sharing

General

Target

a07410f5b618fd091c0ad7db523b3c2f365bc5a762303cf3ae9280b985196ced
Size

361KB
Sample

221109-pspv1sadhl
MD5

d7973feebc008f5448e7f6f847e6cae1
SHA1

6675717c8dca7f4589d9a9f63267cf6de86dbc4e
SHA256

a07410f5b618fd091c0ad7db523b3c2f365bc5a762303cf3ae9280b985196ced
SHA512

53aa470d91dab757cebad56df0f0973f190308621b4a1ca652028b72217696b088be36688b9b77f6d5f1ed27479da91b076ba321a060a0e8ec0f7e9248bca83b
SSDEEP

6144:PtxXarVLsZ2zBrbMcaWX89Hm8TY1S95ulwdeHork+tUjqqxH+SMRe7xA6SoExJBI:lYhLNRbf89N95uW4Skf5NxMRe7W6BUbE

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  de43a2031013e66780820a2fa5fb9871a21c97be4a42e65cd1a6efffb222c95c
- Size
  
  611KB
- MD5
  
  dfa8f311db9cb2886f75989267bbd47f
- SHA1
  
  3c476565086765f896f4bf99b2900c0c1a427384
- SHA256
  
  de43a2031013e66780820a2fa5fb9871a21c97be4a42e65cd1a6efffb222c95c
- SHA512
  
  bb935e031e25f7ff4ef54d3b788c44d692449cecc3354628b27efa534840b202c721a6c93a4ff586fbdf222ab4905f74245588974a228c227c24787db145bcc4
- SSDEEP
  
  12288:h1GVyBfUDi9EUb4kAH/w0mpKMgxxcLHgh:uVy1UDCb3sFxFh
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer