Rewterz Threat Alert – Phobos Ransomware – Active IOCs

Severity

High

Analysis Summary

Phobos ransomware appeared at the beginning of 2019. It has been noted that this new strain of ransomware is strongly based on the previously known family: Dharma (a.k.a. Crysis), and probably distributed by the same group as Dharma. Phobos is one of the ransomware that is distributed via hacked Remote Desktop (RDP) connections. This isn’t surprising, as hacked RDP servers are a cheap commodity on the underground market, and can make for an attractive and cost-efficient dissemination vector for threat groups. This ransomware does not deploy any techniques of UAC bypass. When we try to run it manually, the UAC confirmation pops up:

Impact

• File Encryption
• Data Exfiltration

Indicators of Compromise

MD5

• 860953455aaf8ad66b16d5c36cd13ea5

SHA-256

• dce79399a715f77b8963a549b88ed1d92929b6876cf31b373c24177720f134ba

SHA-1

• 0f85d94014567bd7199d5df015cb42df57f4bf32

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.