phobos | 9090b682c6219cb43f01d5b3342356ae85685992fac80e5e08667b54439932ea | Triage

Resubmissions

27-05-2024 07:08

240527-hye5fach43 10

27-05-2024 07:07

240527-hxneesch25 10

Sharing

General

Target

176-Phobos.zip
Size

39KB
Sample

240527-hxneesch25
MD5

fd04e1ab2bacdd5baedaf6242fb79e41
SHA1

c73ff7888457c98a8d775c96035e6bc259c1d747
SHA256

9090b682c6219cb43f01d5b3342356ae85685992fac80e5e08667b54439932ea
SHA512

58cf5cb8653281581cb3d7c68cabc1e2962b9314af63328f3ccdf45385c29292eec2d533ed2daa9ec7957f23202756e3ff35a367596c777a8868b98e75eccfa1
SSDEEP

768:4+SW2AEywpVJU/61jKxYp6vlvybVtA0sUhTvhwKR59Fpel9j4dkpG/:dF2ppVJJ2mg0sUhTmqjFpS9cdk0/

Score

10^/10

phobos defense_evasion evasion execution impact persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  43f846c12c24a078ebe33f71e8ea3b4f75107aeb275e2c3cd9dc61617c9757fc
- Size
  
  55KB
- MD5
  
  4e93c194b641d9b849f270531ec14d20
- SHA1
  
  8b5a21254a0c10e3ca2570eeba490755197b544e
- SHA256
  
  43f846c12c24a078ebe33f71e8ea3b4f75107aeb275e2c3cd9dc61617c9757fc
- SHA512
  
  0c6dba53321b00a7b17bde84598de18cad9ecdae1a36209b6f13a99df96abe86987c2cbef132c6bc0ce80de75b4ad15351abd8c0c8e5c83bc17bb4f64713f2ec
- SSDEEP
  
  1536:YNeRBl5PT/rx1mzwRMSTdLpJZtqoQOcO:YQRrmzwR5JAOF
Score

10^/10

phobos defense_evasion evasion execution impact persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (136) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

phobosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer