phobos | 41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf | Triage

Sharing

General

Target

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eafexe.exe
Size

56KB
Sample

240111-y7kdhsfheq
MD5

dc2d809e46c60ee990844ee7fbdc17cd
SHA1

839ce9c0e3cab37d4de0b25460d9b0dc047bb2ae
SHA256

41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf
SHA512

0c3ddc1e5071a45b5c95165b655d1b0a1ba9538fd4066ec62a7904c60974671250b27634e29d35c08658936e3674683b990e3bbc81307ee5fbfce52a2df675c7
SSDEEP

1536:UNeRBl5PT/rx1mzwRMSTdLpJPQG9TY28U:UQRrmzwR5Jop28U

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eafexe.exe
- Size
  
  56KB
- MD5
  
  dc2d809e46c60ee990844ee7fbdc17cd
- SHA1
  
  839ce9c0e3cab37d4de0b25460d9b0dc047bb2ae
- SHA256
  
  41dbdaeb1dc8fe40358a5e168af596da85c6a84796e63c9d10c11f2077129eaf
- SHA512
  
  0c3ddc1e5071a45b5c95165b655d1b0a1ba9538fd4066ec62a7904c60974671250b27634e29d35c08658936e3674683b990e3bbc81307ee5fbfce52a2df675c7
- SSDEEP
  
  1536:UNeRBl5PT/rx1mzwRMSTdLpJPQG9TY28U:UQRrmzwR5Jop28U
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (307) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Query Registry

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomware