phobos | c78d3d8c7b9d6f3adb63d8b89fa87b7fd62d9fb8bb38e828d81e622c87fdfd32 | Triage

Sharing

General

Target

000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.zip
Size

39KB
Sample

240316-mtkxcabd96
MD5

f1c86410de26ba99557b4a6f8de34c63
SHA1

117f3fac0eb442a699fbaf91bae910445161464c
SHA256

c78d3d8c7b9d6f3adb63d8b89fa87b7fd62d9fb8bb38e828d81e622c87fdfd32
SHA512

259fbe93eeefbfeefbc1e2482e0871cfa991c56fe0d0eab8619dc796779569162bdfbef370d01d35e0a77e2f78f29afb9feadf7f84e984fca45551fb7e09b4cd
SSDEEP

768:zlijCAwUhSHUMlvas3uk4Yx6taQBRL8X/EvAvL6aiplnHbVl3mjlsx:JijCLUoHUVs3ukX8R8X/S0QlTm5E

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Targets

- Target
  
  000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe
- Size
  
  55KB
- MD5
  
  ea6d3083f8c1c506fbff457bf09a7ed8
- SHA1
  
  f159c4fc7d13571e725f0ae9e0749c77cf859b4e
- SHA256
  
  000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46
- SHA512
  
  1167b9ebe03c399c5915394592f97ce60bd07e92f589a4a0d794255c7a9c46423dd28efbf96b45aab6a67763a20676627f35683cc6790bf1383c7f07b6e28405
- SSDEEP
  
  1536:ENeRBl5PT/rx1mzwRMSTdLpJVIVAxN/0nVS12:EQRrmzwR5JiWxNIJ
Score

10^/10

phobos evasion persistence ransomware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (63) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomware