MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Phobos


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718
SHA3-384 hash: 4096541993db4622e25b59a21f948412bb39b4d2e90a97eb44892f9d84c3902997caf35069663042d710a139b4af8f42
SHA1 hash: 1e0946ea29e3eca33384ccab5a627d778a6e612d
MD5 hash: 6275a839b5071bf445539c8652d2b13b
humanhash: charlie-early-delaware-sweet
File name:6275a839b5071bf445539c8652d2b13b.exe
Download: download sample
Signature Phobos
Create hunting rule
File size:1'086'360 bytes
First seen:2021-01-11 07:40:49 UTC
Last seen:2021-01-11 10:54:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 34688f6e75b1bb27a358488e10a9abac (3 x RemcosRAT, 2 x Loki, 1 x Phobos)
ssdeep 12288:SNZGyaAmYrFHmXVCu/BnA3ddRw+kRnSYeCRqlZVpiiiiiOvp:SN0DiZ0knO+MnS5CclZ7iiiiiM
Threatray 25 similar samples on MalwareBazaar
TLSH C83581A86478649FF3B24236DC02F134E996DF662046612A3497E7FB5832384D51EF2E
Reporter abuse_ch
Tags:exe ModiLoader Phobos Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'518
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6275a839b5071bf445539c8652d2b13b.exe
Verdict:
Malicious activity
Analysis date:
2021-01-11 07:45:45 UTC
Tags:
installer ransomware
Link:
https://app.any.run/tasks/6292b943-411e-4929-aec0-07d6ba88f61b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/111207/
Detection(s):
SecuriteInfo.com.Generic.mg.6275a839b5071bf4.24009.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Launching a service
Launching cmd.exe command interpreter
Creating a process with a hidden window
Changing a file
Modifying an executable file
Creating a file in the Program Files subdirectories
Creating a file in the %AppData% subdirectories
Creating a file in the Windows subdirectories
Replacing executable files
Creating a file in the Program Files directory
Using the Windows Management Instrumentation requests
Moving a file to the Program Files subdirectory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Deleting volume shadow copies
Creating a file in the mass storage device
Preventing system recovery
Enabling autorun by creating a file
Encrypting user's files
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Phobos
Create hunting rule
Detection:
malicious
Classification:
rans.spre.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/577638
Signature
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Creates a thread in another existing process (thread injection)
Creates files in the recycle bin to hide itself
Creates files inside the volume driver (system volume information)
Creates multiple autostart registry keys
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Drops PE files to the startup folder
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Delete shadow copy via WMIC
Sigma detected: WannaCry Ransomware
Submitted sample is a known malware sample
Uses bcdedit to modify the Windows boot settings
Writes many files with high entropy
Writes to foreign memory regions
Yara detected Phobos
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 337873 Sample: T9tAui44l4.exe Startdate: 11/01/2021 Architecture: WINDOWS Score: 100 67 Sigma detected: WannaCry Ransomware 2->67 69 Multi AV Scanner detection for submitted file 2->69 71 Yara detected Phobos 2->71 73 9 other signatures 2->73 8 T9tAui44l4.exe 1 21 2->8         started        13 Vwfdllution.exe 17 2->13         started        15 Vwfdllution.exe 16 2->15         started        17 6 other processes 2->17 process3 dnsIp4 53 1drv.ws 168.235.93.122, 443, 49718, 49720 RAMNODEUS United States 8->53 55 bn-files.fe.1drv.com 8->55 57 0s0pua.bn.files.1drv.com 8->57 49 C:\Users\user\Contacts\Vwfdllution.exe, PE32 8->49 dropped 81 Creates multiple autostart registry keys 8->81 83 Writes to foreign memory regions 8->83 85 Allocates memory in foreign processes 8->85 19 ieinstal.exe 2 232 8->19         started        59 bn-files.fe.1drv.com 13->59 61 0s0pua.bn.files.1drv.com 13->61 87 Multi AV Scanner detection for dropped file 13->87 89 Creates a thread in another existing process (thread injection) 13->89 91 Injects a PE file into a foreign processes 13->91 24 ieinstal.exe 13->24         started        63 bn-files.fe.1drv.com 15->63 65 0s0pua.bn.files.1drv.com 15->65 26 ieinstal.exe 15->26         started        93 Creates files inside the volume driver (system volume information) 17->93 file5 signatures6 process7 dnsIp8 51 192.168.2.1 unknown unknown 19->51 41 C:\Users\user\AppData\...\ieinstal.exe, PE32 19->41 dropped 43 C:\ProgramData\Microsoft\...\ieinstal.exe, PE32 19->43 dropped 45 UpdateNotification...r@foxmail.com].help, data 19->45 dropped 47 256 other files (253 malicious) 19->47 dropped 75 Creates files in the recycle bin to hide itself 19->75 77 Creates multiple autostart registry keys 19->77 79 Infects executable files (exe, dll, sys, html) 19->79 28 cmd.exe 1 19->28         started        31 ieinstal.exe 19->31         started        file9 signatures10 process11 signatures12 95 May disable shadow drive data (uses vssadmin) 28->95 97 Deletes shadow drive data (may be related to ransomware) 28->97 99 Uses bcdedit to modify the Windows boot settings 28->99 101 Deletes the backup plan of Windows 28->101 33 conhost.exe 28->33         started        35 vssadmin.exe 1 28->35         started        37 WMIC.exe 28->37         started        39 3 other processes 28->39 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-11 07:28:31 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cxmk4abugcovaqsfjm4nzn6jacc65ow6eneaeszsw5jkmnkw4ma._file
Verdict:
malicious
Similar samples:
03bb4d5c0179fdceacc5df7645e6e7fa93e931ac9beb1968c7bbe40ba3499194
Phobos
2eff58738b5a7717a3fcdf7a4171c6fa18492bc200eddc26bf608fa35d28466e
Phobos
4f2a4b35cda0c85b4a0ead82e8af588d7812d79206a104ff638619aa869aade4
Phobos
667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83
Phobos
7949bf3e09366bdb23ca7472cb6c4d9183ad5b081ac5a568d556aec8beae0785
Phobos
8104295d1d2338902c8eb82cf3b7724e9bf65bd1b8b098c8d181dd5df9753b78
Phobos
977f77728f1783062f8c072096f0b7535ec74f686c3e40db5dc78766edabffeb
Phobos
9dde984b21a00bc3307c28bd81f229500b795ce4e908b6f8cb5fbd338b22b8e1
Phobos
dea38651b06aab617e93bdb343fd28587bdc0e113a4fc957571a06988491ade7
Phobos
f9348fb8d78baa055f90288fec94b67d3f3d30eaa5744feeacef871ee3ad8eb8
Phobos
+ 15 additional samples on MalwareBazaar
Result
Malware family:
phobos
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:phobos evasion persistence ransomware trojan
Link:
https://tria.ge/reports/210111-s6ytr1ebc2/
Behaviour
Interacts with shadow copies
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Drops file in Program Files directory
Adds Run key to start application
Drops desktop.ini file(s)
Drops startup file
Deletes backup catalog
Deletes shadow copies
Modifies boot configuration data using bcdedit
Phobos
ModiLoader, DBatLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718
MD5 hash:
6275a839b5071bf445539c8652d2b13b
SHA1 hash:
1e0946ea29e3eca33384ccab5a627d778a6e612d
Link:
https://www.unpac.me/results/19f15e2d-87e2-4c44-8412-70ae54aa8f05/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Phobos

Executable exe f0aec57001a184ea82122a59c6e5be48042f75d6f11a40125995ba9531aab718

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/952159/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/111207/

Comments