phobos | e3e4765fd6625bc94593e751557021aca9cadf5d6d068b41562bc52acf752d1a | Triage

Sharing

General

Target

000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.zip
Size

39KB
Sample

240229-kppnmabg7t
MD5

8872859c53a9a93402ecd46d6bbe159b
SHA1

a74dac6bb2ca19825061285a7311e82002bed318
SHA256

e3e4765fd6625bc94593e751557021aca9cadf5d6d068b41562bc52acf752d1a
SHA512

b36ae177e26cf8d045fadb0ea03fdd400e3cd3b79eda38031c2b08dc3ea52071c5ecc0f912952c720bf1037415de83afc59ad58c99cd0c25fac062ee5a73f30c
SSDEEP

768:oPIsEURk0L0XinxpNHumy5b/m6aT8ihfb/TviJUx88wH7GTJHgG3j/Zkzil:HUW/SXkmWm6arfb/TvzC7jCV

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe
- Size
  
  55KB
- MD5
  
  ea6d3083f8c1c506fbff457bf09a7ed8
- SHA1
  
  f159c4fc7d13571e725f0ae9e0749c77cf859b4e
- SHA256
  
  000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46
- SHA512
  
  1167b9ebe03c399c5915394592f97ce60bd07e92f589a4a0d794255c7a9c46423dd28efbf96b45aab6a67763a20676627f35683cc6790bf1383c7f07b6e28405
- SSDEEP
  
  1536:ENeRBl5PT/rx1mzwRMSTdLpJVIVAxN/0nVS12:EQRrmzwR5JiWxNIJ
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (365) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer