AA24-060A #StopRansomware Phobos Ransomware Indicators The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA, to disseminate known TTPs and IOCs associated with the Phobos ransomware variants observed as recently as February 2024, according to open source reporting. Phobos is structured as a ransomware-as-a-service (RaaS) model. Since May 2019, Phobos ransomware incidents impacting state, local, tribal, and territorial (SLTT) governments have been regularly reported to the MS-ISAC. These incidents targeted municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several million U.S. dollars. The FBI, CISA, and the MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of Phobos ransomware and other ransomware incidents. //node() | //@* DISCLAIMER: This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. The DHS does not endorse any commercial product or service, referenced in this bulletin or otherwise. This document is distributed as TLP:WHITE: Disclosure is not limited. For more information on the Traffic Light Protocol, see https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage. 2024-02-29T00:00:00Z Malicious File Indicator File Hash Watchlist 1570442295 MD5 0900B61FEBED8DA43708F6735ED6C11B SHA1 90B2CEBBEB377480E321D8F38EA6DE2FA661E437 SHA256 7451BE9B65B956EE667081E1141531514B1EC348E7081B5A9CD1308A98EEC8F0 SSDEEP 3072:omlcfKKkQybVuof03Vo7NLLDzqgFsvz+io254PAQ243/q6WvMt/9eYikt9BfoQ:ogcfKKkQybVuof03Vo7NPDzPWvz+iEo7 Malicious File Indicator File Hash Watchlist Ahpdate.exe MD5 20D9FA474FA2628A6ABE5485D35EE7E0 SHA1 A28AF73BCFD4EBE2FE29242C07FEC15E0578EC8A SHA256 0000599CBC6E5B0633C5A6261C79E4D3D81005C77845C6B0679D854884A8E02F SSDEEP 12288:mm0+bjvfBp6pOcQmqtPxGKw3genar9XW6Y:Awn6UcQmEPx2wem9XWf Malicious E-mail Indicator Malicious E-mail carljohnson1948@gmx.com Malicious E-mail Indicator Malicious E-mail zodiacx@tuta.io Malicious E-mail Indicator Malicious E-mail helpforyou@onionmail.org Malicious E-mail Indicator Malicious E-mail zgen@tuta.io Malicious E-mail Indicator Malicious E-mail helpforyou@gmx.com Malicious E-mail Indicator Malicious E-mail xspacegroup@protonmail.com Malicious E-mail Indicator Malicious E-mail helpfiles102030@inboxhub.net Malicious E-mail Indicator Malicious E-mail xgen@tuta.io Malicious E-mail Indicator Malicious E-mail xdone@tutamail.com Malicious E-mail Indicator Malicious E-mail starcomp@keemail.me Malicious E-mail Indicator Malicious E-mail helperfiles@gmx.com Malicious E-mail Indicator Malicious E-mail stafordpalin@protonmail.com Malicious E-mail Indicator Malicious E-mail greenbookbtc@protonmail.com Malicious E-mail Indicator Malicious E-mail spacegroup@tuta.io Malicious E-mail Indicator Malicious E-mail greenbookbtc@gmx.com Malicious E-mail Indicator Malicious E-mail sory@countermail.com Malicious E-mail Indicator Malicious E-mail getdata@gmx.com Malicious E-mail Indicator Malicious E-mail skymix@tuta.io Malicious E-mail Indicator Malicious E-mail fredmoneco@tutanota.com Malicious E-mail Indicator Malicious E-mail secdatltd@gmx.com Malicious E-mail Indicator Malicious E-mail fquatela@techie.com Malicious E-mail Indicator Malicious E-mail saraconor@gmx.com Malicious E-mail Indicator Malicious E-mail fastway@tuta.io Malicious E-mail Indicator Malicious E-mail samuelwhite1821@tutanota.com Malicious E-mail Indicator Malicious E-mail expertbox@tuta.io Malicious E-mail Indicator Malicious E-mail recovery2021@onionmail.org Malicious E-mail Indicator Malicious E-mail everymoment@tuta.io Malicious E-mail Indicator Malicious E-mail recovery2021@inboxhub.net Malicious E-mail Indicator Malicious E-mail crashonlycash@gmx.com Malicious E-mail Indicator Malicious E-mail precorpman@onionmail.org Malicious E-mail Indicator Malicious E-mail cox.barthel@aol.com Malicious E-mail Indicator Malicious E-mail please@countermail.com Malicious E-mail Indicator Malicious E-mail colexpro@keemail.me Malicious E-mail Indicator Malicious E-mail nud_satanakia@keemail.me Malicious E-mail Indicator Malicious E-mail clausmeyer070@cock.li Malicious E-mail Indicator Malicious E-mail normanbaker1929@gmx.com Malicious E-mail Indicator Malicious E-mail claredrinkall@aol.com Malicious E-mail Indicator Malicious E-mail michaelwayne1973@tutanota.com Malicious E-mail Indicator Malicious E-mail chocolate_muffin@tutanota.com Malicious E-mail Indicator Malicious E-mail miadowson@tuta.io Malicious E-mail Indicator Malicious E-mail cashonlycash@gmx.com Malicious E-mail Indicator Malicious E-mail megaport@tuta.io Malicious E-mail Indicator Malicious E-mail mccreight.ellery@tutanota.com Malicious E-mail Indicator Malicious E-mail blair_lockyer@aol.com Malicious E-mail Indicator Malicious E-mail matheuscosta0194@gmx.com Malicious E-mail Indicator Malicious E-mail bill.gteam@gmx.com Malicious E-mail Indicator Malicious E-mail luiza.li@tutanota.com Malicious E-mail Indicator Malicious E-mail bill.g@onionmail.org Malicious E-mail Indicator Malicious E-mail lettointago@onionmail.com Malicious E-mail Indicator Malicious E-mail bill.g@msgsafe.io Malicious E-mail Indicator Malicious E-mail joshuabernandead@gmx.com Malicious E-mail Indicator Malicious E-mail bill.g@gmx.com Malicious E-mail Indicator Malicious E-mail jonson_eight@gmx.us Malicious E-mail Indicator Malicious E-mail bernard.bunyan@aol.com Malicious E-mail Indicator Malicious E-mail johnwilliams1887@gmx.com Malicious E-mail Indicator Malicious E-mail barenuckles@tutanota.com Malicious E-mail Indicator Malicious E-mail it.issues.solving@outlook.com Malicious E-mail Indicator Malicious E-mail axdus@tuta.io Malicious E-mail Indicator Malicious E-mail info@fobos.one Malicious E-mail Indicator Malicious E-mail atomicday@tuta.io Malicious E-mail Indicator Malicious E-mail henryk@onionmail.org Malicious E-mail Indicator Malicious E-mail albetpattisson1981@protonmail.com Malicious File Indicator File Hash Watchlist MD5 69788B170956A5C58EBD77F7680FDE7C SHA1 43683751209E85571072D953C0BDD44C883045EE SHA256 F3BE35F8B8301E39DD3DFFC9325553516A085C12DC15494A5E2FCE73C77069ED SSDEEP 768:/vrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1ExPZXYX5SPXMz:BNeRBl5PT/rx1mzwRMSTdLpJxhXDfxs Malicious File Indicator File Hash Watchlist MD5 62885D0F106569FAC3985F72F0CA10CB SHA1 CB37B10B209AB38477D2E17F21CAE12A1CB2ADF0 SHA256 58626A9BFB48CD30ACD0D95DEBCAEFD188AE794E1E0072C5BDE8ADAE9BCCAFA6 SSDEEP 1536:sNeRBl5PT/rx1mzwRMSTdLpJNr+eiukbsSw:sQRrmzwR5JViums Malicious File Indicator File Hash Watchlist MD5 9376F223D363E28054676BB6EF2C3E79 SHA1 AED68CFA282EC2B0F8A681153BEAEBE3A17D04EE SHA256 2704E269FB5CF9A02070A0EA07D82DC9D87F2CB95E60CB71D6C6D38B01869F66 SSDEEP 1536:hNeRBl5PT/rx1mzwRMSTdLpJgL0UHg1tuP4ib:hQRrmzwR5JS0UA1Rib Malicious File Indicator File Hash Watchlist MD5 B119CDD3D02B60009B9AD39DA799ED3B SHA1 B092A6BF7FB6755E095ED9F35147D1C6710CF2C4 SHA256 FC4B14250DB7F66107820ECC56026E6BE3E8E0EB2D428719156CF1C53AE139C6 SSDEEP 1536:fRvoU+XfE9ICf4t1OwruWiyB055fGDlfG:f6X89NfsjruWiydZG Malicious File Indicator File Hash Watchlist SHA256 32A674B59C3F9A45EFDE48368B4DE7E0E76C19E06B2F18AFB6638D1A080B2EB3 Malicious File Indicator File Hash Watchlist fe2d1879880466e24e76d8d0963feb93.exe MD5 FE2D1879880466E24E76D8D0963FEB93 SHA1 18EBB65842CCD3A1D1EEB597F2017267D47DAAF9 SHA256 9215550CE3B164972413A329AB697012E909D543E8AC05D9901095016DD3FC6C SSDEEP 6144:YVtrvQVm+214icCgPMmcCs+XhmOi/h/dD2YYWs6+ClKflgjBMf:Y/QVQ1D/Nmfs+XhZodDWWsJClkCj Malicious File Indicator File Hash Watchlist a567048dd823ff2d395ddd95d1fa5302.exe MD5 A567048DD823FF2D395DDD95D1FA5302 SHA1 7332956DEBC4FB14A54D69B0B858BD5B04BECAC1 SHA256 482754D66D01AA3579F007C2B3C3D0591865EB60BA60B9C28C66FE6F4AC53C52 SSDEEP 24576:Y9mJWeLfEmWZOLJCj4ZYM9UA6/OUO7oNmXKj8okyH7l/meRG:5LfELGUO7oNm6j8okLI Malicious File Indicator File Hash Watchlist SecuriteInfo.com.Win32.PWSX-gen.218.3876 MD5 ECDF7ACB35E4268BCAFB03B8AF12F659 SHA1 93B0D892BD3FBB7D3D9EFB69FFFDC060159D4536 SHA256 C0539FD02CA0184925A932A9E926C681DC9C81B5DE4624250F2DD885CA5C4763 SSDEEP 12288:UzRlcffXwJsWFAFnjJPQJq+6byL3z5SjMa1jkSC9U:ujB0JYcAa1S Malicious FQDN Indicator Domain Watchlist adstat477d.xyz Malicious FQDN Indicator Domain Watchlist demstat577d.xyz Malicious FQDN Indicator Domain Watchlist serverxlogs21.xyz Malicious File Indicator File Hash Watchlist 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c; 518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c.exe 287744 MD5 2809E15A3A54484E042FE65FFFD17409 SHA1 4A8F0331ABAF8F629B3C8220F0D55339CFA30223 SHA256 518544E56E8CCEE401FFA1B0A01A10CE23E49EC21EC441C6C7C3951B01C1B19C SSDEEP 3072:D5IwIMZKkczttW5ivhjqKO1I9Goh6F4mAqeormMkpCWlunhNGA5yjszVIEe9:NIMsztZZ+KQqGo5QfmLpCoun6W Malicious E-mail Indicator Malicious E-mail helpfiles@onionmail.org Malicious IPv4 Indicator IP Watchlist 147.78.47.224 Malicious E-mail Indicator Malicious E-mail helpermail@onionmail.org Malicious File Indicator File Hash Watchlist f1425cff3d28afe5245459afa6d7985081bc6a62f86dce64c63daeb2136d7d2c.bin MD5 DB74CD067D4A0562B26EA4F10E943E3B SHA1 33DEF89AD18A6C3DBAA4B5B5075A84A771157441 SHA256 F1425CFF3D28AFE5245459AFA6D7985081BC6A62F86DCE64C63DAEB2136D7D2C SSDEEP 1536:EGK2GvyWya1pamI5f23vvdWjJfLqcKXkLReWk2Q9Gusz22/:T6qWFamI5mvgJfGcoYvQ9+ Malicious IPv4 Indicator IP Watchlist 185.202.0.111 Malicious IPv4 Indicator IP Watchlist 194.165.16.4 Malicious File Indicator File Hash Watchlist MD5 E59FFEAF7ACB0C326E452FA30BB71A36 SHA1 C88FAD293256BFEAD6962124394DE4F8B97765AA SHA256 A91491F45B851A07F91BA5A200967921BF796D38677786DE51A4A8FE5DDEAFD2 SSDEEP 1536:zkGB8nHbKUvryElSpi8jCZGcqDKlKnr8dV+99rmuoENA4Cj:zFBMHRvrAjCZmKcnr8YrfA4Cj Reconnaissance - Active Scanning: Scanning IP Blocks [T1595.001] Reconnaissance - Phishing for Information [T1598] Reconnaissance - Search Open Websites/Domains [T1593] Resource Development - Establish Accounts [T1585] Resource Development - Obtain Capabilities: Tool [T1588.002] Initial Access - External Remote Services [T1133] Initial Access - Phishing: Spearphishing Attachment [T1566.001] Initial Access - Valid Accounts [T1078] Execution - Command and Scripting Interpreter: Windows Command Shell [T1059.003] Execution - Native API [T1106] Execution - User Execution: Malicious File [T1204.002] Execution - Windows Management Instrumentation [T1047] Persistence - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder [T1547.001] Privilege Escalation - Access Token Manipulation: Create Process with Token [T1134.002] Privilege Escalation - Access Token Manipulation: Token Impersonation/Theft [T1134.001] Privilege Escalation - Process Injection: Asynchronous Procedure Call [T1055.004] Privilege Escalation - Process Injection: Portable Executable Injection [T1055.002] Defense Evasion - Deobfuscate/Decode Files or Information [T1140] Defense Evasion - Impair Defenses [T1562] Defense Evasion - Impair Defenses: Disable or Modify System Firewall [T1562.004] Defense Evasion - Obfuscated Files or Information: Embedded Payloads [T1027.009] Defense Evasion - Obfuscated Files or Information: Software Packing [T1027.002] Defense Evasion - System Binary Proxy Execution: Mshta [T1218.005] Credential Access - Brute Force [T1110] Credential Access - Credentials from Password Stores [T1555] Credential Access - Credentials from Password Stores: Credentials from Web Browsers [T1555.003] Credential Access - Credentials from Password Stores: Password Managers [T1555.005] Credential Access - OS Credential Dumping: Cached Domain Credentials [T1003.005] Credential Access - OS Credential Dumping: LSASS Memory [T1003.001] Discovery - Account Discovery: Domain Account [T1087.002] Discovery - File and Directory Discovery [T1083] Discovery - Process Discovery [T1057] Discovery - System Information Discovery [T1082] Collection - Archive Collected Data [T1560] Command and Control - Application Layer Protocol: File Transfer Protocols [T1071.002] Command and Control - Data Obfuscation: Protocol Impersonation [T1001.003] Command and Control - Remote Access Software [T1219] Command and Control - Remote File Copy [T1105] Exfiltration - Exfiltration Over Alternative Protocol [T1048] Exfiltration - Exfiltration Over Web Service: Exfiltration to Cloud Storage [T1567.002] Impact - Data Encrypted for Impact [T1486] Impact - Inhibit System Recovery [T1490]