phobos

General

Target

77709ccfdd8b04d98eee33db53d68e51_JaffaCakes118
Size

332KB
Sample

240527-bnhz1sba9x
MD5

77709ccfdd8b04d98eee33db53d68e51
SHA1

c72f56c1330704aae591ca7e029399a6aaf6036f
SHA256

a7c1f86f505e55bec1323327c159ff3ecbdc37b847f26aed4ee28b9fecba5742
SHA512

b1e6fd8a6a568eadbb9f53de3785f44ac0b559dfa6be6b1b3ae3b14db70f35f2c69742ae0647a3010779238ea48d1bdd78cc953deab229f760c5c27348ebc949
SSDEEP

3072:UubHlt9Q/K0+Z3DEsmaey0WmPDL4VhBjnMvHlGDu2e9cMFGYhzFfqZVuoKMuu:DH7E4eF23IvHlouxcAG42uZ3

Score

10^/10

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC. If you want to restore them, there are 2 ways of contact:</div> <div class='bold'>1. Jabber contact - [email protected]</div> <div class='bold'>- https://www.wikihow.com/Create-a-Jabber-Account</div> <div class='bold'>- https://psi-im.org/download/</div> <div class='bold'>- Once you created a jabber account. Make sure you add the contact first and wait for our approval to begin sending message.</div> <div class='bold'>- Directly messaging us with out accepting your request will result to Forbidden message</div> <div class='bold'>2. Bitmessage contact address- BM-2cVoXfF2BdYyfxBrady3hopZN6izutPyEr</div> <div class='bold'>- https://bitmessage.org/wiki/Main_Page</div> <div class='bold'>- After all the sync is finish. You can directly send message here.</div> <div class='bold'>Try both method of contact to ensure we receive your message.</div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>Where to buy bitcoins?</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

Emails

[email protected]</div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

https://www.wikihow.com/Create-a-Jabber-Account</div>

https://psi-im.org/download/</div>

https://bitmessage.org/wiki/Main_Page</div>

Targets

- Target
  
  77709ccfdd8b04d98eee33db53d68e51_JaffaCakes118
- Size
  
  332KB
- MD5
  
  77709ccfdd8b04d98eee33db53d68e51
- SHA1
  
  c72f56c1330704aae591ca7e029399a6aaf6036f
- SHA256
  
  a7c1f86f505e55bec1323327c159ff3ecbdc37b847f26aed4ee28b9fecba5742
- SHA512
  
  b1e6fd8a6a568eadbb9f53de3785f44ac0b559dfa6be6b1b3ae3b14db70f35f2c69742ae0647a3010779238ea48d1bdd78cc953deab229f760c5c27348ebc949
- SSDEEP
  
  3072:UubHlt9Q/K0+Z3DEsmaey0WmPDL4VhBjnMvHlGDu2e9cMFGYhzFfqZVuoKMuu:DH7E4eF23IvHlouxcAG42uZ3
Score

10^/10

phobos discovery persistence ransomware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Renames multiple (513) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2