Dosya Kimligi
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| Dosya Adi | LisectAVT_2403002C_164.exe |
| Boyut | 73.728 byte |
| String Sayisi | 434 |
Mutex Uniqueness Kontrol
CreateMutexW, OpenMutexW, ReleaseMutex -- Tekli instance kontrolu (cift enfeksiyon engeli)
LisectAVT Ornegi
Phobos Hakkinda
Phobos, 2019'dan beri aktif Dharma kaynakli ransomware ailesidir. Dijital imzasiz exe, mutex uniqueness kontrolu, AES-256 + RSA-1024 hibrit sifreleme kullanir. C2 yok — iletisim ransom note email adresi uzerinden saglanir. RDP brute force ile yayilir.
IOC
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| Mutex | CreateMutexW (tekli instance) |
| Yayilma | RDP Brute Force |
Phobos — Malware Profile
Phobos, 2019 dan beri aktif Dharma kaynakli ransomware ailesidir. AES-256 + RSA-1024 hibrit sifreleme, email bazli fidye iletisimi. RDP brute force ile yayilir. C2 yok.
Technical Details
Phobos ransomware emerged in December 2018 as a derivative of Dharma/CrySis ransomware. Encrypts files using AES-256 with RSA-1024 key exchange. Files are renamed with victim ID, attacker email address, and .phobos extension. Distributed primarily through RDP brute force attacks. Deletes volume shadow copies via vssadmin, disables Windows recovery, and terminates backup processes. Adds persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key and Startup folder. Contact is exclusively via email embedded in ransom note (no web portal). Variant of Dharma that emerged after its source code leaked on underground forums.
Attribution / Threat Actor
WIZARD SPIDER (related lineage), Dharma/CrySis family
Capabilities & Behavior
IOC List (1 indicators)
# SHA256
4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c
| Type | Value | Note |
|---|---|---|
| sha256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c | len=63 |