General

  • Target

    Trojan-Ransom.Win32.Zerber.gdcx-4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304.exe

  • Size

    148KB

  • Sample

    220929-pt4essbhbr

  • MD5

    3ce563e899291b59fa8c57c98cad9b4e

  • SHA1

    7157cc9cf910735727b6601ad4d532cdd0fedc7e

  • SHA256

    4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304

  • SHA512

    827dc0e9f9212ec0d4c1e8c7180c33d387548f7de6d0b45a2eef01f22f69ee571d3f2f8b610b8f671f4b25abaa578431ce758a5e41740e7b8c63ca85ef953469

Malware Config

Extracted

Path

\??\c:\_R_E_A_D___T_H_I_S___RE50_.txt

Family

cerber

Ransom Note Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/4BA7-57EA-FF88-0098-B2A6 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/4BA7-57EA-FF88-0098-B2A6 2. http://xpcx6erilkjced3j.19kdeh.top/4BA7-57EA-FF88-0098-B2A6 3. http://xpcx6erilkjced3j.1mpsnr.top/4BA7-57EA-FF88-0098-B2A6 4. http://xpcx6erilkjced3j.18ey8e.top/4BA7-57EA-FF88-0098-B2A6 5. http://xpcx6erilkjced3j.17gcun.top/4BA7-57EA-FF88-0098-B2A6 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://xpcx6erilkjced3j.onion/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.1n5mod.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.19kdeh.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.1mpsnr.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.18ey8e.top/4BA7-57EA-FF88-0098-B2A6

http://xpcx6erilkjced3j.17gcun.top/4BA7-57EA-FF88-0098-B2A6

Targets

    • Target

      Trojan-Ransom.Win32.Zerber.gdcx-4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304.exe

    • Size

      148KB

    • MD5

      3ce563e899291b59fa8c57c98cad9b4e

    • SHA1

      7157cc9cf910735727b6601ad4d532cdd0fedc7e

    • SHA256

      4a8031fc97753e95eb440a1f0f100ddcfbca0bca0bb2271dbc775e129282f304

    • SHA512

      827dc0e9f9212ec0d4c1e8c7180c33d387548f7de6d0b45a2eef01f22f69ee571d3f2f8b610b8f671f4b25abaa578431ce758a5e41740e7b8c63ca85ef953469

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

    • Modifies WinLogon for persistence

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

    • Wannacry

      WannaCry is a ransomware cryptoworm.

    • mimikatz is an open source tool to dump credentials on Windows

    • Contacts a large (1116) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Modifies file permissions

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix