Phobos / 8Base: Forensic Reverse-Engineering & Architectural Dossier

Phobos (and its high-profile rebranding 8Base) is a compact, high-efficiency ransomware strain written in native C/C++ targeting the Win32 API. Operating with a binary footprint under 100 KB, Phobos does not require runtime frameworks or third-party cryptographic libraries. The payload executes multi-threaded file encryption using AES-256 in CBC mode with RSA key encapsulation, renames files using the distinctive Crysis identifier syntax, and deploys both text files and interactive HTML Application (HTA) windows via mshta.exe.

{
  "--scan-network": "Triggers multi-threaded ARP and NetBIOS scanning to locate accessible SMB shares on local subnets.",
  "--elevate": "Executes programmatic auto-elevation routine via COM moniker or ShellExecute runas.",
  "--priority-vss": "Forces immediate execution of volume shadow copy deletion routines prior to drive traversal.",
  "--no-note": "Suppresses dropping of text (info.txt) and HTML Application (info.hta) ransom notes.",
  "--path": "Restricts encryption execution strictly to the specified folder or mount point.",
  "--silent": "Runs completely silent without allocating console window or spawning MSHTA GUI."
}

{
  "description": "Embedded configuration block in .rdata section directly descended from the Crysis/Dharma ransomware lineage",
  "fields": [
    "0x00: RSA public key in CryptoAPI PUBLICKEYBLOB format (BLOBHEADER + RSAPUBKEY + modulus)",
    "0x110: 8-byte hexadecimal victim identifier seed",
    "0x118: Primary operator contact email string (e.g., support@onionmail.com)",
    "0x158: Secondary operator contact email string (e.g., backup@proton.me)",
    "0x198: Telegram or Jabber contact handle string",
    "0x1D8: Appended file extension string format: .id[{id}].[{email}].phobos (or .8base / .devos)",
    "0x218: File exclusion blacklist: info.hta, info.txt, boot.ini, ntuser.dat",
    "0x280: Directory exclusion blacklist: Windows, ProgramData, Tor Browser"
  ]
}

{
  "initialization": "Binary starts and checks for active instance via named mutex (Global\\{victim_id} or Phobos_Mutex). Acquires SeDebugPrivilege via AdjustTokenPrivileges.",
  "defenseImpairment": "Executes shell commands to disable Windows Firewall: netsh advfirewall set currentprofile state off. Deletes shadow copies: vssadmin delete shadows /all /quiet and bcdedit /set {default} recoveryenabled no.",
  "persistenceInstallation": "Copies executable to %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ and creates registry Run key in HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run.",
  "volumeEnumeration": "Enumerates drive letters A:\\ through Z:\\ via GetLogicalDriveStringsW and GetDriveTypeW. If --scan-network is enabled, enumerates network resources via WNetOpenEnumW.",
  "cryptographicProcessing": "Spawns worker threads via CreateThread for each drive. Traverses filesystem with FindFirstFileW. Files <= 1.5 MB are encrypted fully; larger files have header and periodic blocks encrypted. Encrypts with AES-256-CBC, appends RSA-encrypted session key and PHOBOS header, and renames file to .id[...].[email].phobos.",
  "ransomDelivery": "Drops info.txt and info.hta in processed directories. Spawns mshta.exe to render interactive GUI ransom notice."
}

Concrete technical breakdown of functional modules implemented in the Phobos / 8Base binary:

Phobos primarily coordinates extortion operations through decentralized encrypted communication channels, including privacy-focused email providers (ProtonMail, OnionMail) and Jabber (XMPP) messaging handles specified in the configuration block. Affiliates also provide Tor V3 Onion mirror portals for automated payment processing and decryptor distribution.

Indicators of compromise and forensic patterns recorded across laboratory triage: