cerber

General

Target

5607414907c0494f734000ba029c6b74a0eafdf2bfbecc24d410855108635100
Size

382KB
Sample

220725-gtsz3aaabp
MD5

432ad4941c057927786e3b6646ecf2f3
SHA1

45babe449954544219054e327523de5812597eaa
SHA256

5607414907c0494f734000ba029c6b74a0eafdf2bfbecc24d410855108635100
SHA512

8b8fa755cf8a18fe7a822edcb977e8d8ee7615ccc56f5eac5c4eb7113f1faa8c983a9da18a08923c7e14d1bc86f2cae7d0a98322e8fcb8fb180733c0e9b04ab3

Score

10^/10

Malware Config

Targets

- Target
  
  5607414907c0494f734000ba029c6b74a0eafdf2bfbecc24d410855108635100
- Size
  
  382KB
- MD5
  
  432ad4941c057927786e3b6646ecf2f3
- SHA1
  
  45babe449954544219054e327523de5812597eaa
- SHA256
  
  5607414907c0494f734000ba029c6b74a0eafdf2bfbecc24d410855108635100
- SHA512
  
  8b8fa755cf8a18fe7a822edcb977e8d8ee7615ccc56f5eac5c4eb7113f1faa8c983a9da18a08923c7e14d1bc86f2cae7d0a98322e8fcb8fb180733c0e9b04ab3
Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer suricata
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Modifies visiblity of hidden/system files in Explorer
  evasion
- suricata: ET MALWARE Ransomware/Cerber Checkin 2
  suricata: ET MALWARE Ransomware/Cerber Checkin 2
  suricata
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds policy Run key to start application
  persistence
- Contacts a large (514) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (530) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2