phobos | 523d97331fcef84ff767dbb01836766d8b1be9bbeb3d76e9fda3a02ad46fd976 | Triage

Submit
Reports

Overview

overview

Static

static

7

rundll64.exe

windows7-x64

rundll64.exe

windows10-2004-x64

Sharing

General

Target

rundll64.exe
Size

236KB
Sample

230502-h4cw9saa44
MD5

4165a3dba3c7ac26b225f8623f70ebaa
SHA1

587df43d63da7dfd726a4bb8f39877647cc07da0
SHA256

523d97331fcef84ff767dbb01836766d8b1be9bbeb3d76e9fda3a02ad46fd976
SHA512

43ad74651aad95f16bd17f6fea857534c6c6502cb0c06262092e7b10ab59a27b663565668d6fd4436c72a114f632ab6940fc4f1914d165eba7e5a8a8b5743b8e
SSDEEP

6144:qb/A0SeQu0hL2cyBt2iOjese1HSCRhECwt6:q8D5P2ICsDCRhQ6

Score

10^/10

phobos evasion persistence ransomware spyware stealer upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

rundll64.exe

Resource

win7-20230220-en

phobos evasion persistence ransomware spyware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

rundll64.exe

Resource

win10v2004-20230220-en

phobos evasion persistence ransomware spyware stealer

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  rundll64.exe
- Size
  
  236KB
- MD5
  
  4165a3dba3c7ac26b225f8623f70ebaa
- SHA1
  
  587df43d63da7dfd726a4bb8f39877647cc07da0
- SHA256
  
  523d97331fcef84ff767dbb01836766d8b1be9bbeb3d76e9fda3a02ad46fd976
- SHA512
  
  43ad74651aad95f16bd17f6fea857534c6c6502cb0c06262092e7b10ab59a27b663565668d6fd4436c72a114f632ab6940fc4f1914d165eba7e5a8a8b5743b8e
- SSDEEP
  
  6144:qb/A0SeQu0hL2cyBt2iOjese1HSCRhECwt6:q8D5P2ICsDCRhQ6
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer

© 2018-2024

Terms | Privacy