文件 Kimligi
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| 文件 Adi | LisectAVT_2403002C_164.exe |
| 大小 | 73.728 byte |
| String Sayisi | 434 |
Mutex Uniqueness Kontrol
CreateMutexW, OpenMutexW, ReleaseMutex -- Tekli instance kontrolu (cift enfeksiyon engeli)
LisectAVT Ornegi
Phobos Hakkinda
Phobos, 2019'dan beri aktif Dharma kaynakli ransomware ailesidir. Dijital imzasiz exe, mutex uniqueness kontrolu, AES-256 + RSA-1024 hibrit sifreleme kullanir. C2 yok — iletisim ransom note email adresi uzerinden saglanir. RDP brute force ile yayilir.
IOC
| SHA256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c |
|---|---|
| Mutex | CreateMutexW (tekli instance) |
| Yayilma | RDP Brute Force |
Phobos — 恶意软件档案
Phobos, 2019 dan beri aktif Dharma kaynakli ransomware ailesidir. AES-256 + RSA-1024 hibrit sifreleme, email bazli fidye iletisimi. RDP brute force ile yayilir. C2 yok.
技术细节
Phobos ransomware emerged in December 2018 as a derivative of Dharma/CrySis ransomware. Encrypts files using AES-256 with RSA-1024 key exchange. Files are renamed with victim ID, attacker email address, and .phobos extension. Distributed primarily through RDP brute force attacks. Deletes volume shadow copies via vssadmin, disables Windows recovery, and terminates backup processes. Adds persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key and Startup folder. Contact is exclusively via email embedded in ransom note (no web portal). Variant of Dharma that emerged after its source code leaked on underground forums.
归因 / 威胁行为者
WIZARD SPIDER (related lineage), Dharma/CrySis family
能力与行为
IOC列表 (1 个指标)
# SHA256
4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c
| 类型 | 值 | 备注 |
|---|---|---|
| sha256 | 4ff314143f6fea355f4f78fb8b09e44fdad0e9e74de7e3db69e75edbc3ee75c | len=63 |