phobos | 62b096449d5dc6f876c43e48d1c27a63de0f75e70279f811b5c6ba18f9126f7b | Triage

Sharing

General

Target

62b096449d5dc6f876c43e48d1c27a63de0f75e70279f811b5c6ba18f9126f7b.exe
Size

56KB
Sample

221219-ld7kqsef92
MD5

9d698f5fb023c21b0629273b0ef42594
SHA1

76ba11bfc956c6c68b8d34731f6573e308d6771b
SHA256

62b096449d5dc6f876c43e48d1c27a63de0f75e70279f811b5c6ba18f9126f7b
SHA512

c04548373451fc1d02031bf4957a9c07882c15639304c7a5e5d1e37dbe27afe94ccdaa0f2db3f08ce333415260d25be78fc7984f17ba7194c32be74c3bdc50ed
SSDEEP

768:zvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EHC6HHZTg4qfH:9NeRBl5PT/rx1mzwRMSTdLpJHRH5Q9d

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  62b096449d5dc6f876c43e48d1c27a63de0f75e70279f811b5c6ba18f9126f7b.exe
- Size
  
  56KB
- MD5
  
  9d698f5fb023c21b0629273b0ef42594
- SHA1
  
  76ba11bfc956c6c68b8d34731f6573e308d6771b
- SHA256
  
  62b096449d5dc6f876c43e48d1c27a63de0f75e70279f811b5c6ba18f9126f7b
- SHA512
  
  c04548373451fc1d02031bf4957a9c07882c15639304c7a5e5d1e37dbe27afe94ccdaa0f2db3f08ce333415260d25be78fc7984f17ba7194c32be74c3bdc50ed
- SSDEEP
  
  768:zvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EHC6HHZTg4qfH:9NeRBl5PT/rx1mzwRMSTdLpJHRH5Q9d
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer