General
-
Target
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270.sample
-
Size
125KB
-
Sample
210726-pd1j5wqmxn
-
MD5
c4472cd02b1396ca49935f029db6a8ec
-
SHA1
fa4891fc8416a191d255fc186ef534d022d665e2
-
SHA256
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270
-
SHA512
4a7463bc0a6a88d6eb7b2964b6212429ae8a7cd5f02abda2ecabecb1b2b374419fc48c4124386bdf184cef6f27ede998d245c3a0dbb97050e1639c7fb1a37ce5
Static task
static1
Behavioral task
behavioral1
Sample
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.onion.to/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.cab/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.nu/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.link/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.tor2web.org/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion/AA89-A485-DC83-0006-4055
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.cab/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.nu/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion.link/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.tor2web.org/AA89-A485-DC83-0006-4055
http://cerberhhyed5frqa.onion/AA89-A485-DC83-0006-4055
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.onion.to/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.cab/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.nu/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.link/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.tor2web.org/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion/FAA9-7BEC-BA9A-0006-420A
Extracted
C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
http://cerberhhyed5frqa.onion.to/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.cab/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.nu/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion.link/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.tor2web.org/FAA9-7BEC-BA9A-0006-420A
http://cerberhhyed5frqa.onion/FAA9-7BEC-BA9A-0006-420A
Targets
-
-
Target
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270.sample
-
Size
125KB
-
MD5
c4472cd02b1396ca49935f029db6a8ec
-
SHA1
fa4891fc8416a191d255fc186ef534d022d665e2
-
SHA256
392e471bab3700300378fd83bc108576acb6246f19c502972c00ddb4b9bac270
-
SHA512
4a7463bc0a6a88d6eb7b2964b6212429ae8a7cd5f02abda2ecabecb1b2b374419fc48c4124386bdf184cef6f27ede998d245c3a0dbb97050e1639c7fb1a37ce5
-
suricata: ET MALWARE Ransomware/Cerber Checkin 2
-
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (11)
-
suricata: ET MALWARE Ransomware/Cerber Checkin M3 (16)
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-