Pay or Lose Your Critical Data – Deep Analysis of A New Phobos Ransomware Variant
Phobos ransomware family was first spotted by security researchers in early 2019. Recently our Lab captured one sample from the wild, which is a MS Word document containing malicious Macro to spread a new variant of Phobos.
I did a research on this MS Word sample thoroughly. In this talk, I will represent:
- How the malicious Macro in the MS Word document executes to infect the victim’s system;
- How the real ransomware payload starts on the victim’s system;
- What techniques it uses to keep it persistent on the victim’s system;
- How it enumerates and filters the files and encrypts them on the victim’s system;
- What encryption algorithm this variant uses and how the encryption key is generated;
- At last, what the victim has to do to restore the encrypted files.
Xiaopeng Zhang has worked in cyber security industry more than 14 years.
He works for Fortinet’s FortiGuard Labs as a senior security researcher.
In the last several years, he has been focusing on monitoring and analyzing various kinds of malware like RAT, Spyware, Ransomware, Trojan as well as other popular sophisticated network applications like Tor.
He has published many technical vulnerability and malware analysis blogs.
Sponsors and Supporting Organizations
Networking Lounge Sponsor