phobos | ecf6807ca8fa203fa534673f26af5121ff2e36cac93535139fc73b9fc8316b64 | Triage

Resubmissions

14-06-2023 16:01

230614-tgmnqsbb91 10

20-02-2023 17:20

230220-vwr3fabg33 10

20-02-2023 16:59

230220-vhjtxabf79 10

Sharing

General

Target

1.exe
Size

56KB
Sample

230220-vhjtxabf79
MD5

cfab0d0fe983e37aa514f3979c3f2b3c
SHA1

2fc3580b9f0c1f86f4d3f44a4b58f0d4efbd72eb
SHA256

ecf6807ca8fa203fa534673f26af5121ff2e36cac93535139fc73b9fc8316b64
SHA512

708c6a72becc067561e7dfc6f17238808ea9647c14ff6975e82424b4e5806f900af0ecd3b48ade5d6f56953410b5864a7ec47f8c393569a595618fb907d0327d
SSDEEP

768:vvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1E5NdESVxvUNCL:RNeRBl5PT/rx1mzwRMSTdLpJ5UPNBu+

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  1.exe
- Size
  
  56KB
- MD5
  
  cfab0d0fe983e37aa514f3979c3f2b3c
- SHA1
  
  2fc3580b9f0c1f86f4d3f44a4b58f0d4efbd72eb
- SHA256
  
  ecf6807ca8fa203fa534673f26af5121ff2e36cac93535139fc73b9fc8316b64
- SHA512
  
  708c6a72becc067561e7dfc6f17238808ea9647c14ff6975e82424b4e5806f900af0ecd3b48ade5d6f56953410b5864a7ec47f8c393569a595618fb907d0327d
- SSDEEP
  
  768:vvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1E5NdESVxvUNCL:RNeRBl5PT/rx1mzwRMSTdLpJ5UPNBu+
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer