phobos | 4b3409b3ca48f1eda3db0bcc76b904d0922d9321b19d3e77580b58f01943afa6 | Triage

Resubmissions

09-01-2025 07:25

250109-h8za3asrft 10

30-01-2020 12:45

200130-h445yv6ryx 10

Sharing

General

Target

emotet-stopper-v1.4.exe
Size

293KB
Sample

250109-h8za3asrft
MD5

ee81815d74cc3d07deeb6776dae9f0da
SHA1

1268e0b6dc3c60b03ea436f0783812ec4f85b8a0
SHA256

4b3409b3ca48f1eda3db0bcc76b904d0922d9321b19d3e77580b58f01943afa6
SHA512

a25d8da3a8f50a868e4fd3d901cd7adb108ae6de755a149e38cd6353625a95ce5f84c7ab3a63ead7685c67459bcc677f4c06c8887888092cfc471608e82675db
SSDEEP

6144:QUp0VQJElM+hny4rAOhZzIRF2jmHA5EGyCQjjAOEF8Xw7pPKW:QXSJIThd8OzzIRcWTCQXKFf7pPKW

Score

10^/10

phobos discovery ransomware

Malware Config

Targets

- Target
  
  emotet-stopper-v1.4.exe
- Size
  
  293KB
- MD5
  
  ee81815d74cc3d07deeb6776dae9f0da
- SHA1
  
  1268e0b6dc3c60b03ea436f0783812ec4f85b8a0
- SHA256
  
  4b3409b3ca48f1eda3db0bcc76b904d0922d9321b19d3e77580b58f01943afa6
- SHA512
  
  a25d8da3a8f50a868e4fd3d901cd7adb108ae6de755a149e38cd6353625a95ce5f84c7ab3a63ead7685c67459bcc677f4c06c8887888092cfc471608e82675db
- SSDEEP
  
  6144:QUp0VQJElM+hny4rAOhZzIRF2jmHA5EGyCQjjAOEF8Xw7pPKW:QXSJIThd8OzzIRcWTCQXKFf7pPKW
Score

10^/10

phobos discovery ransomware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Phobos family
  phobos
- Windows Defender anti-emulation file check
  Defender's emulator always creates certain fake files which can be used to detect it.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

phobosdiscoveryransomware

behavioral2

phobosdiscoveryransomware