cerber | e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678

Target
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Size 604KB
Sample191029-64114c38xs
SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
MD5 8b6bc16fd137c09a08b02bbe1bb7d670
SHA1 c69a0f6c6f809c01db92ca658fcf1b643391a2b7
SHA512 b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Path

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/617C-211C-EEEE-0446-9A8B Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/617C-211C-EEEE-0446-9A8B 2. http://p27dokhpz2n7nvgr.14ewqv.top/617C-211C-EEEE-0446-9A8B 3. http://p27dokhpz2n7nvgr.14vvrc.top/617C-211C-EEEE-0446-9A8B 4. http://p27dokhpz2n7nvgr.129p1t.top/617C-211C-EEEE-0446-9A8B 5. http://p27dokhpz2n7nvgr.1apgrn.top/617C-211C-EEEE-0446-9A8B ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

Path

\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___A092GY_.txt

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/301B-43E5-38DC-0446-91C2 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/301B-43E5-38DC-0446-91C2 2. http://p27dokhpz2n7nvgr.14ewqv.top/301B-43E5-38DC-0446-91C2 3. http://p27dokhpz2n7nvgr.14vvrc.top/301B-43E5-38DC-0446-91C2 4. http://p27dokhpz2n7nvgr.129p1t.top/301B-43E5-38DC-0446-91C2 5. http://p27dokhpz2n7nvgr.1apgrn.top/301B-43E5-38DC-0446-91C2 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs