Phobos Ransomware (<ID>-<id***8 random>.[<email>].phobos) Support

Wait for Emmanuel_ADC-Soft go to the forum.

There are holidays in Europe now, many people are not working these days.

Edited by Amigo-A, 02 January 2019 - 02:54 PM.

I again

Dr Web identified the ramson as Trojan.Encoder.3953v4+

Best regards

Trojan.Encoder.3953v4+

 

DrWeb cannot decrypt it yet. Link >>

jfsantos

You can upload the sample of malware you have in HA here, and give me in PM a link to the analysis result.

Edited by Amigo-A, 03 January 2019 - 01:12 PM.

I again

 

Dr Web identified the ramson as Trojan.Encoder.3953v4+

 

Best regards

hmm,

according to the DrWeb classification - Trojan.Encoder.3953 is Crysis.

https://vms.drweb.ru/virus/?i=8051858&virus_name=Trojan.Encoder.3953

according to ESET .id-% hexnum% .-- [% EmailAddress%]. PHOBOS - this is also Crysis.

although I never personally met on the forums.

@jfsantos

for analysis, the executable file is needed, not just a ransom note and encrypted files

https://www.hybrid-analysis.com/sample/e2c72f16830eff906515f60f899d6971636b4ef6a25e08ed7601938a564226a9

You can also check the system using FRST,
https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
and provide us with a validation log.

Edited by al1963, 04 January 2019 - 11:24 AM.

CrySiS == Dharma, and Phobos does not have the same file structure as Dharma. Unless they found a sample of the malware and confirm it is a new variant of Dharma with some drastic changes to the structure, I believe they are mistaken.

Dharma has the filemarker "00000000020000000CFE7A410000000000000000000000002000000000000000" followed by the original filename as widechars and some campaign ID I think. I haven't analysed the rest of the file structure honestly, but I assume it is the encrypted key and other meta data like the original filesize.

These Phobos encrypted files do not have that marker, and ends with 4 ASCII uppercase letters (correlating to the email address), and 2 ASCII numbers; or just "PHOBOS".

Edited by Amigo-A, 04 January 2019 - 12:30 PM.

ESET has long defined .phobos as one of the variants of Crysis. another question: is it right or not?
Because the structure of an encrypted .phobos file is noticeably different from the structure of a typical encrypted Dharma file.
Therefore, we need an executable file of the encoder .phobos

Edited by al1963, 04 January 2019 - 12:34 PM.

@Demonslay335,

Hello Guys, any news? I have my Thesis Project Encrypted and lot of works.

I already sent the .ex file they were using.

 

I already sent the .ex file they were using.

 

ESET has long defined .phobos as one of the variants of Crysis. another question: is it right or not?
Because the structure of an encrypted .phobos file is noticeably different from the structure of a typical encrypted Dharma file.
Therefore, we need an executable file of the encoder .phobos

@al1963

Thanks for the info, I've updated IDR with that older filemarker structure. I was able to confirm it with some sample submissions from back then.

Comparing the files, Phobos still looks different. The original CrySiS with IDHex still stored the original filename as widechar, and had some sort of marker after it that is the same between victims of the same email address as far as I can tell.

@architectt

I'm currently analyzing the executable you provided. So far, it doesn't really do anything when run.

Edited by Demonslay335, 08 January 2019 - 12:17 PM.

@al1963

 

Thanks for the info, I've updated IDR with that older filemarker structure. I was able to confirm it with some sample submissions from back then.

 

Comparing the files, Phobos still looks different. The original CrySiS with IDHex still stored the original filename as widechar, and had some sort of marker after it that is the same between victims of the same email address as far as I can tell.

 

 

 

@architectt

 

I'm currently analyzing the executable you provided. So far, it doesn't really do anything when run.

I have more file that were in the same folder of the executable, but those got encrypted has well, the guy left the folder at the Desktop and everything there was encrypted less that .exe

 

Any chance the encrypted system contains this file?
 
C:\Users\<username>\AppData\Local\Temp\k.txt

Any chance the encrypted system contains this file?
 
C:\Users\<username>\AppData\Local\Temp\k.txt

I have an exam at university now, has soon has I get back I will turn on my desktop and search for that, do you recommend to start on SAFE-MODE or is not needed? (sorry my crappy EN)

Safe mode would probably be recommended until the infection has been fully quarantined.

Safe mode would probably be recommended until the infection has been fully quarantined.

21 years without infections, and the first has to kill my THESIS, damm.

Well brb