phobos | a8b59f5025d268a3dee891a8b991f66dcee7cb35b3d296e38a86631b835cf303 | Triage

Sharing

General

Target

2024-05-22_731066cbba8733b1978aed3338721753_phobos
Size

56KB
Sample

240522-becfwafd53
MD5

731066cbba8733b1978aed3338721753
SHA1

0de6b50ee9054a66fba2c8b5acffa6c52934c327
SHA256

a8b59f5025d268a3dee891a8b991f66dcee7cb35b3d296e38a86631b835cf303
SHA512

d7135e216c158baf65b47ab061884668f1cd8acb5a0419f04135d260f06ec3a3d2b9d257e32789963e5942757d190bf53ca494c6255607622fc94254ed34cfbd
SSDEEP

768:DvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EA6m8+V6C/qpL:tNeRBl5PT/rx1mzwRMSTdLpJAmZD

Score

10^/10

phobos defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  2024-05-22_731066cbba8733b1978aed3338721753_phobos
- Size
  
  56KB
- MD5
  
  731066cbba8733b1978aed3338721753
- SHA1
  
  0de6b50ee9054a66fba2c8b5acffa6c52934c327
- SHA256
  
  a8b59f5025d268a3dee891a8b991f66dcee7cb35b3d296e38a86631b835cf303
- SHA512
  
  d7135e216c158baf65b47ab061884668f1cd8acb5a0419f04135d260f06ec3a3d2b9d257e32789963e5942757d190bf53ca494c6255607622fc94254ed34cfbd
- SSDEEP
  
  768:DvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EA6m8+V6C/qpL:tNeRBl5PT/rx1mzwRMSTdLpJAmZD
Score

10^/10

phobos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (309) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

Query Registry

Peripheral Device Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

behavioral2

phobosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer