<— Back

Pay or Lose Your Critical Data – Deep Analysis of A New Phobos Ransomware Variant

Phobos ransomware family was first spotted by security researchers in early 2019. Recently our Lab captured one sample from the wild, which is a MS Word document containing malicious Macro to spread a new variant of Phobos.

I did a research on this MS Word sample thoroughly. In this talk, I will represent:

• How the malicious Macro in the MS Word document executes to infect the victim’s system;
• How the real ransomware payload starts on the victim’s system;
• What techniques it uses to keep it persistent on the victim’s system;
• How it enumerates and filters the files and encrypts them on the victim’s system;
• What encryption algorithm this variant uses and how the encryption key is generated;
• At last, what the victim has to do to restore the encrypted files.

Xiaopeng Zhang

FortiGuard Labs

Xiaopeng Zhang has worked in cyber security industry more than 14 years.

He works for Fortinet’s FortiGuard Labs as a senior security researcher. 

In the last several years, he has been focusing on monitoring and analyzing various kinds of malware like RAT, Spyware, Ransomware, Trojan as well as other popular sophisticated network applications like Tor. 

He has published many technical vulnerability and malware analysis blogs.

Sponsors and Supporting Organizations

Diamond Sponsors

Platinum Sponsor

Networking Lounge Sponsor

Supporting Organization

Associate Sponsors