Extracted

Extracted

• • Target
    763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb.exe
  • Size 66KB
  • SHA256 ffd6d44ce6c0edc53b480d5050d037579e6fda3ce2c996f0a16b20d3c69fc528
  • MD5 eb1254fbcc08143f6e14e9f2dd82995b
  • SHA1 38fe3f1c54c1933cb86968a1abd238498a55ffd8
  • SHA512 9ab4f49d9cae7365eb22b1281adf3e0bfa2f19320f1857fa68fb5d819cfb0f582d8a73a04f87ca50a1b94c117d06d6c96255310cb64db64925b99e53f66f93a2
  • SSDEEP 1536:HNeRBl5PT/rx1mzwRMSTdLpTM3G6+OjDSB0c4a+96tHUSc9u:HQRrmzwR5TpLOiiVWH9c9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phobosevasionpersistenceransomwarespywarestealer

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (310) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2