MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7d50f809a7808ca53c4430d484bb100aaf9c74c6c12080ff888b8c04212f405. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phobos


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7d50f809a7808ca53c4430d484bb100aaf9c74c6c12080ff888b8c04212f405
SHA3-384 hash: 7dcc8471c6d1ffbbf29faf5be7a576ff44b18867e4e4215d674960208812bb225d9fddf3e20ba77ae8fbc2f227ed95b1
SHA1 hash: c2aff10c4275f4814e3ba1f2e34ad4968e243adc
MD5 hash: cfa6070ae2761549ee9382e9a458330c
humanhash: pasta-johnny-october-oven
File name:cfa6070a_by_Libranalysis
Download: download sample
Signature Phobos
Create hunting rule
File size:56'832 bytes
First seen:2021-05-14 12:04:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 851a0ba8fbb71710075bdfe6dcef92eb (67 x Phobos, 2 x Worm.Ramnit)
ssdeep 1536:WNeRBl5PT/rx1mzwRMSTdLpJyq0YFHXGAlQp:WQRrmzwR5JgYN2qQp
Threatray 12 similar samples on MalwareBazaar
TLSH 0143BF05746980B2CE7189B0293A5F5F5FBE560140B848878F395E863ED1477EB3A3BA
Reporter Libranalysis
Tags:Phobos


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'170
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cfa6070a_by_Libranalysis
Verdict:
Malicious activity
Analysis date:
2021-05-14 12:28:44 UTC
Tags:
ransomware phobos
Link:
https://app.any.run/tasks/42bc8cf2-22f5-4010-9bc5-ab4c5457c6d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Phobos
Create hunting rule
Link:
https://www.capesandbox.com/analysis/156601/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a file
Sending a UDP request
Launching cmd.exe command interpreter
Creating a process with a hidden window
Changing a file
Modifying an executable file
Creating a file in the Program Files subdirectories
Launching the process to change network settings
Creating a file in the %AppData% subdirectories
Launching a process
Replacing executable files
Creating a file in the Program Files directory
Moving a file to the Program Files subdirectory
Launching the process to change the firewall settings
Creating a file in the Windows subdirectories
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Enabling autorun for a service
Preventing system recovery
Enabling autorun by creating a file
Encrypting user's files
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.spre.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/782657
Signature
Antivirus / Scanner detection for submitted sample
Creates files in the recycle bin to hide itself
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Drops PE files to the startup folder
Infects executable files (exe, dll, sys, html)
Machine Learning detection for sample
May disable shadow drive data (uses vssadmin)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Modification of Boot Configuration
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Submitted sample is a known malware sample
Uses bcdedit to modify the Windows boot settings
Uses netsh to modify the Windows network and firewall settings
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 415053 Sample: cfa6070a_by_Libranalysis Startdate: 15/05/2021 Architecture: WINDOWS Score: 100 49 Sigma detected: WannaCry Ransomware 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 6 other signatures 2->55 7 cfa6070a_by_Libranalysis.exe 2 501 2->7         started        12 cfa6070a_by_Libranalysis.exe 2->12         started        14 wbengine.exe 3 2->14         started        16 5 other processes 2->16 process3 dnsIp4 47 192.168.2.1 unknown unknown 7->47 39 C:\Users\...\cfa6070a_by_Libranalysis.exe, PE32 7->39 dropped 41 C:\Users\...\cfa6070a_by_Libranalysis.exe, PE32 7->41 dropped 43 C:\...\cfa6070a_by_Libranalysis.exe, PE32 7->43 dropped 45 368 other files (366 malicious) 7->45 dropped 65 Submitted sample is a known malware sample 7->65 67 Creates files in the recycle bin to hide itself 7->67 69 Drops PE files to the startup folder 7->69 75 2 other signatures 7->75 18 cmd.exe 1 7->18         started        21 cmd.exe 1 7->21         started        23 cfa6070a_by_Libranalysis.exe 7->23         started        71 Multi AV Scanner detection for dropped file 12->71 73 Creates files inside the volume driver (system volume information) 14->73 file5 signatures6 process7 signatures8 57 May disable shadow drive data (uses vssadmin) 18->57 59 Deletes shadow drive data (may be related to ransomware) 18->59 61 Uses netsh to modify the Windows network and firewall settings 18->61 63 3 other signatures 18->63 25 bcdedit.exe 1 18->25         started        27 bcdedit.exe 1 18->27         started        29 conhost.exe 18->29         started        37 3 other processes 18->37 31 netsh.exe 3 21->31         started        33 netsh.exe 3 21->33         started        35 conhost.exe 21->35         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7d50f809a7808ca53c4430d484bb100aaf9c74c6c12080ff888b8c04212f405/
Threat name:
Win32.Ransomware.Phobos
Create hunting rule
Status:
Malicious
First seen:
2021-05-13 07:40:00 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
03bb4d5c0179fdceacc5df7645e6e7fa93e931ac9beb1968c7bbe40ba3499194
Phobos
4f2a4b35cda0c85b4a0ead82e8af588d7812d79206a104ff638619aa869aade4
Phobos
6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952
Phobos
7949bf3e09366bdb23ca7472cb6c4d9183ad5b081ac5a568d556aec8beae0785
Phobos
8710ad8fb2938326655335455987aa17961b2496a345a7ed9f4bbfcb278212bc
Phobos
9bd421c6f7f7d8278036944fcad3e04db408619678acf1b2024ef69d85c3932b
Phobos
9dde984b21a00bc3307c28bd81f229500b795ce4e908b6f8cb5fbd338b22b8e1
Phobos
dea38651b06aab617e93bdb343fd28587bdc0e113a4fc957571a06988491ade7
Phobos
f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718
Phobos
f9348fb8d78baa055f90288fec94b67d3f3d30eaa5744feeacef871ee3ad8eb8
Phobos
+ 2 additional samples on MalwareBazaar
Result
Malware family:
phobos
Create hunting rule
Score:
  10/10
Tags:
family:phobos evasion persistence ransomware spyware stealer
Link:
https://tria.ge/reports/210514-z1kbkvza12/
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Drops desktop.ini file(s)
Drops startup file
Reads user/profile data of web browsers
Deletes backup catalog
Modifies Windows Firewall
Modifies extensions of user files
Deletes shadow copies
Modifies boot configuration data using bcdedit
Phobos
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Filecoder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7d50f809a7808ca53c4430d484bb100aaf9c74c6c12080ff888b8c04212f405

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Phobos
Create hunting rule
Author:ditekshen
Description:Detects Phobos ransomware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/156601/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-14 13:24:04 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0001.033] Anti-Behavioral Analysis::Timing/Delay Check QueryPerformanceCounter
2) [B0030.002] Command and Control::Receive Data
3) [C0002.012] Communication Micro-objective::Create Request::HTTP Communication
4) [C0002.017] Communication Micro-objective::Get Response::HTTP Communication
5) [C0002.008] Communication Micro-objective::WinHTTP::HTTP Communication
6) [C0003.001] Communication Micro-objective::Create Pipe::Interprocess Communication
7) [C0003.004] Communication Micro-objective::Write Pipe::Interprocess Communication
8) [C0001.012] Communication Micro-objective::Get Socket Status::Socket Communication
9) [C0001.006] Communication Micro-objective::Receive Data::Socket Communication
10) [C0001.001] Communication Micro-objective::Set Socket Config::Socket Communication
11) [C0029.003] Cryptography Micro-objective::SHA256::Cryptographic Hash
12) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
13) [C0028.002] Cryptography Micro-objective::RC4 KSA::Encryption Key
14) [C0026.002] Data Micro-objective::XOR::Encode Data
15) [C0030.001] Data Micro-objective::MurmurHash::Non-Cryptographic Hash
17) [C0045] File System Micro-objective::Copy File
18) [C0047] File System Micro-objective::Delete File
19) [C0049] File System Micro-objective::Get File Attributes
20) [C0051] File System Micro-objective::Read File
21) [C0050] File System Micro-objective::Set File Attributes
22) [C0052] File System Micro-objective::Writes File
23) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
24) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
25) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
26) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
27) [C0043] Process Micro-objective::Check Mutex
28) [C0042] Process Micro-objective::Create Mutex
29) [C0017] Process Micro-objective::Create Process
30) [C0038] Process Micro-objective::Create Thread
31) [C0018] Process Micro-objective::Terminate Process