phobos | b0e2a8c3c5d57571c7892940ab531925a2b0451964afd3035f1293062ca6d64e | Triage

Sharing

General

Target

mailox.tmp
Size

138KB
Sample

221110-hg8enahddr
MD5

89ecb17e4dd618967b8d31ce34052c2b
SHA1

1c2c6d8809bb77ead595fa41faac6b3861df18aa
SHA256

b0e2a8c3c5d57571c7892940ab531925a2b0451964afd3035f1293062ca6d64e
SHA512

7fa8c7017d8f643943046487ddeff50328db39cd79c6d967e47e788ff0dadc284e34864b4c99bd5b970237e1517e5fb5da4c474cb60f37dfd0c36bcd19855d4c
SSDEEP

3072:dQRrmzwR5JrGJNnVUQRrmzwR5JEQRrmzwR5JS:dQxR5JrGRUQxR5JEQxR5JS

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  mailox.tmp
- Size
  
  138KB
- MD5
  
  89ecb17e4dd618967b8d31ce34052c2b
- SHA1
  
  1c2c6d8809bb77ead595fa41faac6b3861df18aa
- SHA256
  
  b0e2a8c3c5d57571c7892940ab531925a2b0451964afd3035f1293062ca6d64e
- SHA512
  
  7fa8c7017d8f643943046487ddeff50328db39cd79c6d967e47e788ff0dadc284e34864b4c99bd5b970237e1517e5fb5da4c474cb60f37dfd0c36bcd19855d4c
- SSDEEP
  
  3072:dQRrmzwR5JrGJNnVUQRrmzwR5JEQRrmzwR5JS:dQxR5JrGRUQxR5JEQxR5JS
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer