phobos | 78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce | Triage

Sharing

General

Target

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
Size

494KB
Sample

231014-em6w8shf42
MD5

5e86e15a56455a7b230d2a934ad129a5
SHA1

6b0a1beffe90cf58d1e442612458d18b59a852a4
SHA256

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce
SHA512

6dc0c23f825a36db50adf41795a2da3ae962ebd9eef07a923e629a8a32ac2a7aff87e19f1682a259cde6aa83c13c41e7e5ce4f7988680feaaedbe049208401e5
SSDEEP

12288:wWwjzdKu2piK6lVOx7j5S8U9a/tUvuNX7Y:Pwjzd+gE99XAC

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
- Size
  
  494KB
- MD5
  
  5e86e15a56455a7b230d2a934ad129a5
- SHA1
  
  6b0a1beffe90cf58d1e442612458d18b59a852a4
- SHA256
  
  78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce
- SHA512
  
  6dc0c23f825a36db50adf41795a2da3ae962ebd9eef07a923e629a8a32ac2a7aff87e19f1682a259cde6aa83c13c41e7e5ce4f7988680feaaedbe049208401e5
- SSDEEP
  
  12288:wWwjzdKu2piK6lVOx7j5S8U9a/tUvuNX7Y:Pwjzd+gE99XAC
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (132) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

phobosevasionpersistenceransomwarespywarestealer