5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f

General

Target

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f
Size

149KB
Sample

220725-at5wasfecm
MD5

1d864d76040af03041850d855b3b4430
SHA1

136ffd632fde395f42db66d698ebd03c105ed78f
SHA256

5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f
SHA512

96ea45088713a4149cfb96034637d405ad78abba6d6332b3459fecc649e2fcdcfa0bee6acfeb8cd971bec88d2c2cd80ee4e6656d95ad95542c25f2f0c9232721

Score

10^/10

Malware Config

Targets

- Target
  
  5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f
- Size
  
  149KB
- MD5
  
  1d864d76040af03041850d855b3b4430
- SHA1
  
  136ffd632fde395f42db66d698ebd03c105ed78f
- SHA256
  
  5729b6172d5b65e39eefa0466fb7ab63eeda116e82250bcd4755e55dc932f34f
- SHA512
  
  96ea45088713a4149cfb96034637d405ad78abba6d6332b3459fecc649e2fcdcfa0bee6acfeb8cd971bec88d2c2cd80ee4e6656d95ad95542c25f2f0c9232721
Score

10^/10

discovery evasion persistence ransomware spyware stealer suricata
- suricata: ET MALWARE Ransomware/Cerber Checkin 2
  suricata: ET MALWARE Ransomware/Cerber Checkin 2
  suricata
- suricata: ET MALWARE Ransomware/Cerber Checkin M3 (10)
  suricata: ET MALWARE Ransomware/Cerber Checkin M3 (10)
  suricata
- suricata: ET MALWARE Ransomware/Cerber Checkin M3 (2)
  suricata: ET MALWARE Ransomware/Cerber Checkin M3 (2)
  suricata
- Contacts a large (16386) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (16396) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2