phobos | 97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7 | Triage

Sharing

General

Target

97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
Size

270KB
Sample

231011-k5dw3adb7t
MD5

0a2f0447233fa3f8c754fc8142ab6f7a
SHA1

57ad4363343ac0ac26e953bf5473e50327ce3994
SHA256

97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
SHA512

764a1f3b939efa5f1e1e1794064bc3f8de14787c27802f75e352f7c62b4ef8822716c81a6ef32c9eb4100f8e4ae0eb7df9283a3beee3e190d548a472bb8c1117
SSDEEP

6144:Vnc5VNMxG6QK8HwEFd2PTwwfyb2lMIw6Ou6AiC:VgN2G6v8HwQd2PleKVONBC

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
- Size
  
  270KB
- MD5
  
  0a2f0447233fa3f8c754fc8142ab6f7a
- SHA1
  
  57ad4363343ac0ac26e953bf5473e50327ce3994
- SHA256
  
  97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
- SHA512
  
  764a1f3b939efa5f1e1e1794064bc3f8de14787c27802f75e352f7c62b4ef8822716c81a6ef32c9eb4100f8e4ae0eb7df9283a3beee3e190d548a472bb8c1117
- SSDEEP
  
  6144:Vnc5VNMxG6QK8HwEFd2PTwwfyb2lMIw6Ou6AiC:VgN2G6v8HwQd2PleKVONBC
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (85) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer