Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
  • Size 235KB
  • SHA256 2288a0c896757647538a7dab5e0c980b70b173ed36c9e6206f6701dfd4112cfb
  • MD5 0f281d2506515a64082d6e774573afb7
  • SHA1 8949f27465913bf475fceb5796b205429083df58
  • SHA512 f4ddb22c7dec04ca862d3df88e285025e02c185dbb2c061e9d0092ba3e8e8e083ca55612aae6b2d5792038729c55c0eaf193048991c0b06c8639a52017102622
  • SSDEEP 3072:tkq8P0CtmR0TW3gu8/j/ZCTFPBMBbfYjQF5MLyfLTJ1:GPJTOgr/0XgjYY5gULT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phobosevasionpersistenceransomwarespywarestealer

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (310) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2
• • Target
    518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
  • Size 281KB
  • SHA256 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
  • MD5 2809e15a3a54484e042fe65fffd17409
  • SHA1 4a8f0331abaf8f629b3c8220f0d55339cfa30223
  • SHA512 698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
  • SSDEEP 3072:D5IwIMZKkczttW5ivhjqKO1I9Goh6F4mAqeormMkpCWlunhNGA5yjszVIEe9:NIMsztZZ+KQqGo5QfmLpCoun6W
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phobosevasionpersistenceransomwarespywarestealer

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (316) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral3behavioral4
• • Target
    a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5
  • Size 221KB
  • SHA256 a31a45f1c686c1ae2ff1733e7e7636a17010b85091b17bdf68c27543866dfca5
  • MD5 8a62691e9921ee88ab036aba6f9e45eb
  • SHA1 288d8268254bf799aef8db58beb18cb35fd903a1
  • SHA512 75939ee7257ff3a327f89d88612462b31058bb1e09888d055379e77bb2e9c7d7282ba4edfc0e875298318d2bc1fc63741fd8f5e2697855173cf822619ac67a44
  • SSDEEP 3072:jr80jG3/pNoCOTkEY6ARea8TPUwlCIRSrYIv2FSlSDhkE64Jww6+C3Ul:80jWsCOTkE6v8Ti9slF9JwwR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phobosevasionpersistenceransomwarespywarestealer

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (317) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral5behavioral6
• • Target
    b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53
  • Size 56KB
  • SHA256 b4b89828380c4781c7beafa6dce00ae38cd4adc13ad56792996e28c41def5c53
  • MD5 966061cecee2b65fe7149dfa1d0f2c3a
  • SHA1 691ed7b6c4c0bdd824ede0514aacda9d7adc51f1
  • SHA512 da3521494ea83949641137e8e0cc248129d81cb8264619a41b437e0709c445a70ee0ef79863a613c5a1466ca6880b65e1e7e4cefde2513ca6b36a9c7219b8e16
  • SSDEEP 1536:RNeRBl5PT/rx1mzwRMSTdLpJOCHAsua6db57m8POe:RQRrmzwR5JWse
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  phobosevasionpersistenceransomwarespywarestealer

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (312) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral7behavioral8