phobos

General

Target

2024-11-07_47724da2c336d6559be43a6b8e7a926d_phobos
Size

55KB
Sample

241107-g5prsaxcng
MD5

47724da2c336d6559be43a6b8e7a926d
SHA1

c707588eb7d7f4445492031ec19767ba0943d1b2
SHA256

de929acbbdff9326bba4e73051859d88172bead2df8eab42afd90f5e273d8aeb
SHA512

310c84fe23bf508bcb78fbd9c8407460760913f6f986f7d64ef7cc6ff3c3ba617af077c1d01d83f6a7c6c298a0da675b2c95fa732bc92b789d51316d1628eb7c
SSDEEP

1536:7kcgYgbig9EhjWNMSTdwp++lx/qFS5J5dc:7j8ijWNw++lLD5

Score

10^/10

Malware Config

Targets

- Target
  
  2024-11-07_47724da2c336d6559be43a6b8e7a926d_phobos
- Size
  
  55KB
- MD5
  
  47724da2c336d6559be43a6b8e7a926d
- SHA1
  
  c707588eb7d7f4445492031ec19767ba0943d1b2
- SHA256
  
  de929acbbdff9326bba4e73051859d88172bead2df8eab42afd90f5e273d8aeb
- SHA512
  
  310c84fe23bf508bcb78fbd9c8407460760913f6f986f7d64ef7cc6ff3c3ba617af077c1d01d83f6a7c6c298a0da675b2c95fa732bc92b789d51316d1628eb7c
- SSDEEP
  
  1536:7kcgYgbig9EhjWNMSTdwp++lx/qFS5J5dc:7j8ijWNw++lLD5
Score

10^/10

phobos credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Phobos family
  phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (306) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2