Archivo Kimligi
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| Archivo Adi | LisectAVT_2403002C_164.exe |
| Tamaño | 73.728 byte |
| String Sayisi | 434 |
Mutex Uniqueness Kontrol
CreateMutexW, OpenMutexW, ReleaseMutex -- Tekli instance kontrolu (cift enfeksiyon engeli)
LisectAVT Ornegi
Phobos Hakkinda
Phobos, 2019'dan beri aktif Dharma kaynakli ransomware ailesidir. Dijital imzasiz exe, mutex uniqueness kontrolu, AES-256 + RSA-1024 hibrit sifreleme kullanir. C2 yok — iletisim ransom note email adresi uzerinden saglanir. RDP brute force ile yayilir.
IOC
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| Mutex | CreateMutexW (tekli instance) |
| Yayilma | RDP Brute Force |
Phobos — Perfil del malware
Phobos, 2019 dan beri aktif Dharma kaynakli ransomware ailesidir. AES-256 + RSA-1024 hibrit sifreleme, email bazli fidye iletisimi. RDP brute force ile yayilir. C2 yok.
Detalles técnicos
Phobos ransomware emerged in December 2018 as a derivative of Dharma/CrySis ransomware. Encrypts files using AES-256 with RSA-1024 key exchange. Files are renamed with victim ID, attacker email address, and .phobos extension. Distributed primarily through RDP brute force attacks. Deletes volume shadow copies via vssadmin, disables Windows recovery, and terminates backup processes. Adds persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key and Startup folder. Contact is exclusively via email embedded in ransom note (no web portal). Variant of Dharma that emerged after its source code leaked on underground forums.
Atribución / Actor de amenaza
WIZARD SPIDER (related lineage), Dharma/CrySis family
Capacidades y comportamiento
Lista IOC (1 indicadores)
# SHA256
4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c | len=63 |