badrabbit

General

Target

Trojan-Ransom.Win32.Zerber.gdcx-4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304.exe
Size

148KB
Sample

220929-pt4essbhbr
MD5

3ce563e899291b59fa8c57c98cad9b4e
SHA1

7157cc9cf910735727b6601ad4d532cdd0fedc7e
SHA256

4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304
SHA512

827dc0e9f9212ec0d4c1e8c7180c33d387548f7de6d0b45a2eef01f22f69ee571d3f2f8b610b8f671f4b25abaa578431ce758a5e41740e7b8c63ca85ef953469
SSDEEP

3072:/UuL1hDewdkuaLYO/IBK2btFVL1xTevRUyZDDdnN5:/Ue1hyioVgBhnNPK5FZD5n

Score

10^/10

Malware Config

Extracted

Path

\??\c:\_R_E_A_D___T_H_I_S___RE50_.txt

Family

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/4BA7-57EA-FF88-0098-B2A6 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/4BA7-57EA-FF88-0098-B2A6 2. http://xpcx6erilkjced3j.19kdeh.top/4BA7-57EA-FF88-0098-B2A6 3. http://xpcx6erilkjced3j.1mpsnr.top/4BA7-57EA-FF88-0098-B2A6 4. http://xpcx6erilkjced3j.18ey8e.top/4BA7-57EA-FF88-0098-B2A6 5. http://xpcx6erilkjced3j.17gcun.top/4BA7-57EA-FF88-0098-B2A6 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.1n5mod.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.19kdeh.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.1mpsnr.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.18ey8e.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.17gcun.top/4BA7-57EA-FF88-0098-B2A6

Targets

- Target
  
  Trojan-Ransom.Win32.Zerber.gdcx-4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304.exe
- Size
  
  148KB
- MD5
  
  3ce563e899291b59fa8c57c98cad9b4e
- SHA1
  
  7157cc9cf910735727b6601ad4d532cdd0fedc7e
- SHA256
  
  4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304
- SHA512
  
  827dc0e9f9212ec0d4c1e8c7180c33d387548f7de6d0b45a2eef01f22f69ee571d3f2f8b610b8f671f4b25abaa578431ce758a5e41740e7b8c63ca85ef953469
- SSDEEP
  
  3072:/UuL1hDewdkuaLYO/IBK2btFVL1xTevRUyZDDdnN5:/Ue1hyioVgBhnNPK5FZD5n
Score

10^/10

badrabbit cerber mimikatz troldesh wannacry bootkit discovery evasion persistence ransomware trojan upx worm
- BadRabbit
  Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
  ransomware badrabbit
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- Modifies WinLogon for persistence
  persistence
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- mimikatz is an open source tool to dump credentials on Windows
- Contacts a large (1116) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2