phobos | 7abf27c6711f53ea2688bc8b9c30bb0c01e1cd64436e09de83c768ecd49a412e | Triage

Resubmissions

12-03-2024 07:13

240312-h2g37sdc34 10

12-03-2024 07:05

240312-hwxxgabb9y 10

Sharing

General

Target

15699533522.zip
Size

44KB
Sample

240312-hwxxgabb9y
MD5

a9be629bcd1fd1c42924ad20ba8c1f7e
SHA1

71b7cb8e6f64592284194292c31ac47a7c3d49c2
SHA256

7abf27c6711f53ea2688bc8b9c30bb0c01e1cd64436e09de83c768ecd49a412e
SHA512

b0341a59b2ed7f74308dd8e37e79787a9b63773e66372b1f52e45e4f56906f82c97f8ea6b8792992ae72b166699142fa7e0693a39aaaac1577f56a3286179472
SSDEEP

768:ozQtyfIhh0PJUNLGspU4jyKmjcDmoPf2JjUDeoRuTg45pHZQCPInIHYH/Fw5EItN:aQwfcePk3pNjyLjPjADeka3Ph9SQ+e

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  fe2b5fb57399cf0c7607d5aa133910a9500d176e0dd6a45a4ff8485ad4e70412
- Size
  
  60KB
- MD5
  
  e71c0cffb0d9122dca8fc854a55db27c
- SHA1
  
  21f4342e962ab63914a8786343bd2ed36ce86169
- SHA256
  
  fe2b5fb57399cf0c7607d5aa133910a9500d176e0dd6a45a4ff8485ad4e70412
- SHA512
  
  3d7a546e1fe407b8eaafaef2e15807639bdbeb6d5765cb51a45658c619ffc16a2526de8f4b93bf005aff210e0f20d785937f96c426c5fd491aa83a641d1474f3
- SSDEEP
  
  1536:YNeRBl5PT/rx1mzwRMSTdLpJYkrZdbVQJ/l3gN:YQRrmzwR5JT7S/y
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (264) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer

behavioral2

phobosevasionpersistenceransomwarespywarestealer