phobos | 2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90 | Triage

Submit
Reports

Overview

overview

Static

static

2d310cd281...90.exe

windows7-x64

2d310cd281...90.exe

windows10-2004-x64

Sharing

General

Target

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
Size

149KB
Sample

221125-kkemvseb36
MD5

24e0cf05d2d34b1e6efbc7949bd7aa1f
SHA1

dfdf26d8de8f123dbfdc0b4d5a0a967aee454d9b
SHA256

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
SHA512

5b0a000a3dc159de262de88d8721b766ced6424209ab136c5630c4cd0eb4fc0f7e14624b3f6fb08c2b775ab45402fe863975ae43b48c6b9775f67045f29773f2
SSDEEP

3072:iMYxKXZHdlgQhA+zXuIDl33qMDqNfSwAk/GDbjXR4s4npu4:UOltfDl33BDsJAS8R4Xpu

Score

10^/10

phobos evasion persistence ransomware rezer0

Static task

static1

Behavioral task

behavioral1

Sample

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Resource

win7-20220812-en

phobos persistence ransomware rezer0

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe

Resource

win10v2004-20220812-en

phobos evasion persistence ransomware

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
- Size
  
  149KB
- MD5
  
  24e0cf05d2d34b1e6efbc7949bd7aa1f
- SHA1
  
  dfdf26d8de8f123dbfdc0b4d5a0a967aee454d9b
- SHA256
  
  2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
- SHA512
  
  5b0a000a3dc159de262de88d8721b766ced6424209ab136c5630c4cd0eb4fc0f7e14624b3f6fb08c2b775ab45402fe863975ae43b48c6b9775f67045f29773f2
- SSDEEP
  
  3072:iMYxKXZHdlgQhA+zXuIDl33qMDqNfSwAk/GDbjXR4s4npu4:UOltfDl33BDsJAS8R4Xpu
Score

10^/10

phobos persistence ransomware rezer0 evasion
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobospersistenceransomwarerezer0

behavioral2

phobosevasionpersistenceransomware

© 2018-2024

Terms | Privacy