Unpacking Phobos Ransomware: A Reverse Engineering Journey
If you've spent any time analyzing ransomware, you know that the actual encryption algorithm is usually the least interesting part of the malware. The real puzzle is figuring out how it evades detection, digs its claws into the registry, and sets the stage before pulling the trigger.
Recently, I tore apart a sample of Phobos ransomware (associated with the 8Base campaign) for a CyberDefenders lab. Instead of just dumping the Indicators of Compromise (IoCs), I want to walk you through exactly how I approached this binary using Ghidra, ProcMon, and a bit of Python.
1. The Initial Foothold & Evasion
The first thing that stood out when looking at the PE headers was a glaring lie.
Q: Which legitimate DLL is the malware masquerading as?
A: ole32.dll
By inspecting the Portable Executable (PE) headers using tools like PEStudio or CFF Explorer, I saw that the OriginalFilename property claimed the file was ole32.dll. This is a classic masquerading technique. The authors hope a lazy analyst or a baseline Antivirus scan will see a legitimate Windows COM library and look the other way.
[ SHOW METHODOLOGY: PEStudio Analysis ]▼
To uncover the masquerading attempt without executing the malware, follow these steps in a safe sandbox environment:
- Open PEStudio and drag-and-drop the suspicious executable into the interface.
- Navigate to the Version tab in the left-hand directory tree.
- Look at the metadata embedded by the compiler. You will find the
OriginalFilenamestring. - Compare this string (
ole32.dll) against the actual filename of the executable dropped on disk. The mismatch is an immediate red flag indicating the malware author is attempting to hide behind a legitimate Microsoft binary name.
However, firing up ProcMon quickly revealed its true intentions.
Q: What is the first API function the malware calls?
A: CreateProcessW
Lacking Administrator rights upon execution, its very first API call was CreateProcessW to spawn an elevated instance of itself. Once it had Admin rights, it didn't write custom code to bypass the firewall. It simply abused native Windows tools.
Q: What's the first command the malware uses to turn off a critical security measure?
A: netsh advfirewall set currentprofile state off
By silently spawning a command shell to execute that command, the front door was kicked wide open.
2. Identifying the Variant & Cryptography
I wanted to know exactly what version of Phobos I was dealing with, but standard string extraction came up empty. The version strings were obfuscated.
Q: What is the malware's version?
A: 2.9.1
During dynamic analysis, I stumbled across a developer backdoor. If you create a dummy file named suppo and place it in the same directory as the executable, the malware enters a hidden debug mode. It generates a log file that helpfully spills its own secrets.
Q: What is the hashing algorithm used by the malware?
A: 0D55F8833
Instead of reading thousands of lines of Assembly, I searched the memory in Ghidra for standard cryptographic constants. This led me straight to 0xEDB88320—the universal magic constant for CRC32.
3. Digging in for the Long Haul (Persistence)
Q: What is the address of the function used for persistence?
A: sub_401236
To find out how Phobos survives a reboot, I jumped into Ghidra's Symbol Tree and filtered the Imports for registry APIs. I found a call to RegSetValueExW. By tracing the Cross-References (XREFs) backward, I landed in a worker function. Tracing back one more step revealed the Master persistence function controlling the worker.
4. The Need for Speed (Encryption Optimization)
Q: The file size is compared to a specific value. Could you provide this value?
A: 180000
Encrypting massive 50GB database files takes hours, giving the victim time to pull the plug. Phobos is smarter than that. By analyzing the GetFileSize API logic, I noticed the malware checking file sizes against the hex value 0x180000 (which translates to exactly 180,000 bytes, or about 1.5MB).
- If a file is smaller than 1.5MB, it encrypts the whole thing.
- If a file is larger, it utilizes Partial Encryption—skipping the middle and only destroying the file headers and footers.
The file is permanently corrupted, but the encryption finishes in seconds instead of hours.