phobos | 91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4 | Triage

Sharing

General

Target

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
Size

1.7MB
Sample

231026-gkytysdg24
MD5

2519f369f426e4d2cdd88290d1c25d3c
SHA1

e464001902893ab6aea89b8ccfc66f9eb1d45988
SHA256

91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
SHA512

bedda8d51127c186946cdb3755f9bcc049a0efc308ed645de52d58cdffa8fad85778e4a77338f1c3d68bd2b725ff68e5829a4bba8879983f7380df350754d443
SSDEEP

24576:4E6seIAzWNS0LSaN9EBrx+dbsOCK/91/oc1EDnbLmVrkfvDUdhu3z7L/40NM+Sf2:tKpCSrEdbsOn/4sEDnB3z7E0CzzK

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
- Size
  
  1.7MB
- MD5
  
  2519f369f426e4d2cdd88290d1c25d3c
- SHA1
  
  e464001902893ab6aea89b8ccfc66f9eb1d45988
- SHA256
  
  91abe280381d0faf55b521f51d16d8aa022f0cc14b1310334d4fffc3474459d4
- SHA512
  
  bedda8d51127c186946cdb3755f9bcc049a0efc308ed645de52d58cdffa8fad85778e4a77338f1c3d68bd2b725ff68e5829a4bba8879983f7380df350754d443
- SSDEEP
  
  24576:4E6seIAzWNS0LSaN9EBrx+dbsOCK/91/oc1EDnbLmVrkfvDUdhu3z7L/40NM+Sf2:tKpCSrEdbsOn/4sEDnB3z7E0CzzK
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer