malware family

Phobos

unknownentity:malware_familyransomware · 1 source

Phobos exploits open or poorly secured RDP ports to sneak inside networks and execute a ransomware attack, encrypting files and demanding a ransom be paid in bitcoin for returning the files, which in this case are locked with a .phobos extension.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: phobos
kind: malware family
status: unknown
aliases: Java NotDharma
jurisdictions: —
claims naming it: 3 · 0 attributions · 0 relations · 0 events

Identifiers

misp-galaxy 5b8990a3-0e8c-4b81-8d3c-cc8e6b5024ebvia misp-galaxy-ransomware
misp-galaxy d2c7fb08-293e-453b-a213-adeb79505767via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 3 of 3

Phobosransomwarepayment
subjecttransaction81cee7af89…157baf43f8
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm · 8,503,000 sat · time 2021-07-20 07:57 UTC · url https://ransomwhe.re/#address/3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24907btcintel:annotations:24907@v3 sha256:fd1885c306de26b6
confidencetrusted provider · 50
Phobosransomwarepayment
subjecttransactione765646b46…1b12b2dae4
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm · 9,943,000 sat · time 2021-07-20 13:57 UTC · url https://ransomwhe.re/#address/3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_24906btcintel:annotations:24906@v3 sha256:0f56a9c9cb974c93
confidencetrusted provider · 50
Phobosransomwarepayment address
subjectaddress3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw Phobos · url https://ransomwhe.re/#address/3BEohgnpisVfJDhyA3XywGjLs2vqcEG2hm
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_24905btcintel:annotations:24905@v2 sha256:273f01809ce84d1c
confidencetrusted provider · 50

Subjects3 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.