Phobos

**Phobos** is a ransomware-type malicious program that (like most programs of this type) encrypts data/locks files stored and keeps them in this state until a ransom is paid. Phobos renames all encrypted files by adding the ".phobos" extension plus the victim's unique ID and an email address.

For example, "1.jpg" might be renamed to a filename such as "1.jpg.ID-63857777.[job2019@tutanota.com].phobos.

Other variants of Phobos ransomware use the extension for encrypted files: ".[decryptbox@airmail.cc].Adair", ".[hanesworth.fabian@aol.com].deal", ".[restorebackup@qq.com].Caley", ".barak", ".zax", ".BANKS", ".banjo", ".[lockhelp@qq.com].acute", ".1500dollars", ".[danger@countermail.com].blend", ".[helpteam38@protonmail.com].adage", ".[helpyourdata@qq.com].phobos", ".[ramsey\_frederick@aol.com].phobos", ".[wallyredd@aol.com].phoenix", ".[elizabeth67bysthompson@aol.com].phobos", ".[Job2019@tutanota.com] .phobos", ". [Cadillac.407@aol.com] .phobos", ".[beltoro905073@aol.com].phobos" or ".[matrixBTC@keemail.me].phobos".

The email presented in the assigned extension varies. The virus encrypts data using AES cryptography and, after encryption, generates an HTML application ("Phobos.hta") and opens it. This app displays a pop-up window that contains a ransom-demand message.

## Ransom note

In the ransom-demand message, cyber criminals state that all files are encrypted. To decrypt them, victims must contact them via the cadillac.407@aol.com, ottoZimmerman@protonmail.ch, or other email addresses and provide the assigned ID ("Encryption ID").

Phobos developers offer free decryption of some files as 'proof' that they can be trusted and are capable of decryption (have the required decryption tool). They also urge victims to contact them immediately: supposedly, the sooner cyber criminals are contacted, the lower the cost of decryption.

They also warn users of infected computers that only they can provide means to decrypt files. They state that any attempts to use other tools might result in permanent data damage (data loss).

One victim contacted Phobos developers and received a response stating that cost of decryption (at that time) was $3000, however, they also stated that unless payment to a Bitcoin wallet (provided) was made within six hours, the cost would increase by $2000 (total cost of decryption tool would then be $5000).

## More about ransomware

Typically, cyber criminals use cryptography algorithms that generate unique keys and are impossible to 'crack'. Furthermore, ransomware developers store these keys on remote servers controlled only by them.

Decryption without involvement of cyber criminals is generally impossible, however, we recommended that you never trust these people or contact them - they ignore victims once ransom payments are made.

If your computer is infected with Phobos, the best solution is to use an existing data backup and restore files from there. There is no tool currently capable of free file decryption.

## How did ransomware infect my computer?

There are several commonly used ways to infect computers with ransomware, however, it is not known exactly how cyber criminals proliferate Phobos. Typically, ransomware developers proliferate these infections through spam email campaigns, fake software updaters, dubious software download sources, and trojans.

Spam campaigns infect computers through email attachments, which could be Microsoft Office documents, archive files, executables, PDF files, and so on. Cyber criminals send many emails containing malicious attachments hoping that some users will open them.

Opening these attachments/installing malicious software usually results in computer infection with ransomware or other high-risk viruses. Fake software updaters often download and install malware rather than the promised updates, or exploit bugs/flaws of the outdated software.

Cyber criminals use untrustworthy software download sources (such as freeware download websites, free file hosting websites, and peer-to-peer networks) to proliferate malicious files (executables) by presenting them as legitimate.

By downloading and executing (running) them, malware (such as ransomware-type programs) is installed. Trojans are viruses (malicious programs) that, once installed, proliferate ransomware and other infections.