phobos | fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d | Triage

Sharing

General

Target

fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
Size

285KB
Sample

231018-h9rydacc9s
MD5

4db1b428d0e115a810836f937d786f38
SHA1

35e8722f5bf1997d6022fa512f60458470a8999e
SHA256

fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
SHA512

091491e4cb375eceadcff843cef080815b1f802e0182d260d750f7afc8197eb09461ed9b119b04eff0839c627d2630bfb1e9409de0da12086e2d15bb12565109
SSDEEP

6144:mlVD0j3qci00ei4m4d3hJkuRi7g9BOu6xb4YnDy:X2cibT4d3hJLUWwu6F4YW

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Targets

- Target
  
  fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
- Size
  
  285KB
- MD5
  
  4db1b428d0e115a810836f937d786f38
- SHA1
  
  35e8722f5bf1997d6022fa512f60458470a8999e
- SHA256
  
  fd59543a425d2159dfadba8efd4d40178b609ef123a8bc5cf00fe3afef95623d
- SHA512
  
  091491e4cb375eceadcff843cef080815b1f802e0182d260d750f7afc8197eb09461ed9b119b04eff0839c627d2630bfb1e9409de0da12086e2d15bb12565109
- SSDEEP
  
  6144:mlVD0j3qci00ei4m4d3hJkuRi7g9BOu6xb4YnDy:X2cibT4d3hJLUWwu6F4YW
Score

10^/10

phobos evasion persistence ransomware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (54) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosevasionpersistenceransomware