phobos | cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8 | Triage

Sharing

General

Target

cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8.exe
Size

56KB
Sample

230124-zlz3hsdf84
MD5

6c8a41af3344dc63c4a21990f11b4e96
SHA1

0cf67235a9a94f016dfd2d0b0416415f38502a6d
SHA256

cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8
SHA512

bd15674b2a89957b2735a2860fc211c99e494da32a46e913cf9c2d4e9e71131cd7d2894b6fa968825f8f2418d2b9427f8422e8fb498b0c83216e8436f01f9690
SSDEEP

1536:3NeRBl5PT/rx1mzwRMSTdLpJdfeYm+L8i1NNw:3QRrmzwR5JXJL1D

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8.exe
- Size
  
  56KB
- MD5
  
  6c8a41af3344dc63c4a21990f11b4e96
- SHA1
  
  0cf67235a9a94f016dfd2d0b0416415f38502a6d
- SHA256
  
  cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8
- SHA512
  
  bd15674b2a89957b2735a2860fc211c99e494da32a46e913cf9c2d4e9e71131cd7d2894b6fa968825f8f2418d2b9427f8422e8fb498b0c83216e8436f01f9690
- SSDEEP
  
  1536:3NeRBl5PT/rx1mzwRMSTdLpJdfeYm+L8i1NNw:3QRrmzwR5JXJL1D
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer