phobos | f03a24f248158f23930009796f43b06b4d8a64b75f50428a8263da8d22655cd7

Sharing

General

Target
43f846c12c24a078ebe33f71e8ea3b4f75107aeb275e2c3cd9dc61617c9757fc.zip
Size 39KB
Sample260502-txbamsb15z
SHA256 f03a24f248158f23930009796f43b06b4d8a64b75f50428a8263da8d22655cd7
MD5 f6ebe43b0ee29c16994245ab4549e3ea
SHA1 5f54356ad529582e9174fbca60da7ce45bc5780c
SHA512 8957e46f8593e3f293ec6e4cbfdadf15e579aba60ee96301671e76b98b40e8d02c43ddf23034d796f40b7b1a189a26f72486c71c858adafde62041c34bd72cfc
SSDEEP 768:Q9evUha/cO+JgSuGkUkKO5jck1jj4hdDNxMefZgympFt:Q9evUh1fgSuGkUkK9YjCpNxMIZ/mzt
TLSH
T1D203F29F571872B65E417CF812101FB8F460A081829D32D5E3D36A788A1DDEEF52FDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  43f846c12c24a078ebe33f71e8ea3b4f75107aeb275e2c3cd9dc61617c9757fc.exe
- Size 55KB
- SHA256 43f846c12c24a078ebe33f71e8ea3b4f75107aeb275e2c3cd9dc61617c9757fc
- MD5 4e93c194b641d9b849f270531ec14d20
- SHA1 8b5a21254a0c10e3ca2570eeba490755197b544e
- SHA512 0c6dba53321b00a7b17bde84598de18cad9ecdae1a36209b6f13a99df96abe86987c2cbef132c6bc0ce80de75b4ad15351abd8c0c8e5c83bc17bb4f64713f2ec
- SSDEEP 1536:YNeRBl5PT/rx1mzwRMSTdLpJZtqoQOcO:YQRrmzwR5JAOF
- TLSH
  T1E943BF06705A84B3CEB281B0253A6F5B4EFB600544A484574F3D4EDB3ED9076EB3937A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution phobos impact persistence privilege_escalation ransomware spyware stealer
- Family: Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (809) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9