cerber

Sharing

Copy URL

Twitter E-mail

General

Target

Ransomware-master.zip
Size

12.9MB
Sample

231207-st24hscf65
MD5

efa681cd6d0273f63e77611fca0061e2
SHA1

38d19e6845763623f70fa8d9b6fbcf3bdcd3b653
SHA256

7e615d6e77cac47e870af31dedd5e54deb422f65711e4bb09d7186a9efb2cf0f
SHA512

bef1f1d399722af0638326c50a559e0cdf841f3c97c0363dcdab0a3d45cf3be2ac829e4ae291f6d087b7b8749777d03d91cd595fa69f291b2f5a1f5aa01f9498
SSDEEP

393216:Dnax5M2nfFSrjIYVEmu/GyBSqb+JYSWTmq:DnaFnn5mkxbDSW3

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___NHDQ7_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/EE31-EAED-4C22-0446-9893 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893 2. http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893 3. http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893 4. http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893 5. http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/EE31-EAED-4C22-0446-9893

http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893

http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893

http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893

http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893

http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___ZPOKES_.hta

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="EFbWRCGIy" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't yoqje4cfYu find the necessary files? Is the cqcontent of your files not readable? It is normal bedPeAtR47cause the files' names and the data in your files have been encrypOted by "Ce1urber Ransomware". It meCans your files are NOT damageYZgAOfd! Your files are modified only. This modification is reversible. FTLrom now it is not possGit2ible to use your files until they will be decrypted. The only way to dec9Zt9BOPJrypt your files safely is to buy the special decryption software "C63xQVVerber Decryptor". Any attempts to restKJrdNore your files with the thircKAs02d-party software will be fatal for your files! <hr> You can procz7PjbKSeed with purchasing of the decryption softwigtyNare at your personal page: Ple3GK6ase wait...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893</a> If tqqhis page cannot be opened  cliNklqNYINck here  to get a new addrEr3Gess of your personal page. If the addrergJJbss of your personal page is the same as befoWfUclNre after you tried to get a new one, you cXRiYE8gBan try to get a new address in one hour. At thOzMis page you will receive the complete instr6HVuctions how to buy the decryptiZuwon software for restoring all your files. Also at this page you will be able to res2Otore any one file for free to be sure "CerbeHEsEtr Decryptor" will help you. <hr> If your perYoHQCe5sonal page is not availakgp3LVywble for a long period there is another way to open your personal page - instaBm32vxci1tllation and use of Tor Browser: <ol> <li>run your InteoTrnet browser (if you do not know what it is run the Internet Explorer);</li> <li>entp6er or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loadUXm65Ping;</li> <li>on the site you will be offered to dobJRkHBwnload Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ruP0n Tor Browser;</li> <li>connect with the buttdPkW3LA6K9on "Connect" (if you use the English version);</li> <li>a normal Internet bro2EGaIMoRwser window will be opened after the initialization;</li> <li>type or copy the addTZress http://p27dokhpz2n7nvgr.onion/EE31-EAED-4C22-0446-9893 in this browser address bar;</li> <li>preN3QfsPxCss ENTER;</li> <li>the site shoCu7Ox5Ojuld be loaded; if for some reason the site is not loG9zading wait for a moment and try again.</li> </ol> If you have any prmZRvfPloblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searcLRpHHudh bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> AdditCcTXmvGional information: You will fi2mlc4JfvQjnd the instru71zxctions ("*_READ_THIS_FILE_*.hta") for reIA7xyNJstoring your files in any fuUqBVolder with your ench5BEhz3rypted files. The instr71PFDuctions "*_READ_THIS_FILE_*.hta" in the fxoOnQkXolderfs with your encry1nBWJ1dPHppted files are not virmaQ7ga1uses! The instrucE1Lgd5ntions "*_READ_THIS_FILE_*.hta" will heUzuwlp you to dec7AP8Nnsrypt your files. Remembeoz5UrvUr! The worst siQVQnDKZotuation already happdK8s1hjened and now the future of your files de7fk7sAFPpends on your determtk6K6ination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/EE31-EAED-4C22-0446-9893</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/EE31-EAED-4C22-0446-9893</a> في حالة تعذر فتح هذه الصفحة  انقر هنا  لإنشاء عنوان جديد لصفحتك الشخصية. في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://p27dokhpz2n7nvgr.onion/EE31-EAED-4C22-0446-9893 في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضk8V6Qافية: س7وف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة. الإرش3Iادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موZhZujsgpoSقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您找不到所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改了，

Targets

- Target
  
  cerber.exe
- Size
  
  604KB
- MD5
  
  8b6bc16fd137c09a08b02bbe1bb7d670
- SHA1
  
  c69a0f6c6f809c01db92ca658fcf1b643391a2b7
- SHA256
  
  e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
- SHA512
  
  b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
- SSDEEP
  
  6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
Score

10^/10

cerber discovery evasion ransomware
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Contacts a large (1104) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1
- Target
  
  cryptowall.bin
- Size
  
  240KB
- MD5
  
  47363b94cee907e2b8926c1be61150c7
- SHA1
  
  ca963033b9a285b8cd0044df38146a932c838071
- SHA256
  
  45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d
- SHA512
  
  93dfaafc183360829448887a112dd49c90ec5fe50dcd7c7bbc06c1c8daa206eeea5577f726d906446322c731d0520e93700d5ff9cefd730fba347c72b7325068
- SSDEEP
  
  3072:xkeyloECBch6ZCGBGSmHJ0y5lj6jdojK7+MGOXpXx8z3Lp7Yoq:xGlnCIwMpj6ijKfxx8z3F0V
Score

3^/10
behavioral2
- Target
  
  jigsaw
- Size
  
  283KB
- MD5
  
  2773e3dc59472296cb0024ba7715a64e
- SHA1
  
  27d99fbca067f478bb91cdbcb92f13a828b00859
- SHA256
  
  3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
- SHA512
  
  6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
- SSDEEP
  
  6144:7fukPLPvucHiQQQ4uuy9ApZbZWxcZt+kTfMLJTOAZiYSXjjeqXus:7fu5cCT7yYlWi8kTfMLJTOAZiYSXjyqX
Score

10^/10

jigsaw persistence ransomware spyware stealer
- Jigsaw Ransomware
  Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
  ransomware jigsaw
- Renames multiple (3729) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral3
- Target
  
  Locky
- Size
  
  180KB
- MD5
  
  b06d9dd17c69ed2ae75d9e40b2631b42
- SHA1
  
  b606aaa402bfe4a15ef80165e964d384f25564e4
- SHA256
  
  bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3
- SHA512
  
  8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c
- SSDEEP
  
  3072:gzWgfLlUc7CIJ1tkZaQyjhOosc8MKi6KDXnLCtyAR0u1cZ86:gdLl4wkZa/UDiD7ukst1H6
Score

10^/10

locky ransomware
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
behavioral4
- Target
  
  131.exe
- Size
  
  2.3MB
- MD5
  
  409d80bb94645fbc4a1fa61c07806883
- SHA1
  
  4080bb3a28c2946fd9b72f6b51fe15de74cbb1e1
- SHA256
  
  2ecc525177ed52c74ddaaacd47ad513450e85c01f2616bf179be5b576164bf63
- SHA512
  
  a99a2f17d9fbb1da9fb993b976df63afa74317666eca46d1f04e7e6e24149547d1ac7210f673caeae9b23a900528ad6ad0a7b98780eff458d3d505029a06e9ba
- SSDEEP
  
  49152:XM16E7qUoM5NWX7DP+1egOhcraQzK6j97V:c16/rM5oW1ZrRz
Score

1^/10
behavioral5
- Target
  
  Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .com_
- Size
  
  102KB
- MD5
  
  1b2d2a4b97c7c2727d571bbf9376f54f
- SHA1
  
  1fc29938ec5c209ba900247d2919069b320d33b0
- SHA256
  
  7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e
- SHA512
  
  506fc96423e5e2e38078806591e09a6eb3cf924eb748af528f7315aa0b929890823798a3ef2a5809c14023c3ff8a3db36277bc90c7b099218422aafa4e0c2ee0
- SSDEEP
  
  1536:jj+Rj1lGIXKSmE17v97yiqHGMRPtbsLW8/V2k12v1/BDxVyCfCrCAc:jjw6Sf0iqmMnb2W02v3mCf4Nc
Score

3^/10
behavioral6
- Target
  
  027cc450ef5f8c5f653329641ec1fed9.exe
- Size
  
  353KB
- MD5
  
  71b6a493388e7d0b40c83ce903bc6b04
- SHA1
  
  34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
- SHA256
  
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
- SHA512
  
  072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
- SSDEEP
  
  6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
Score

10^/10

mimikatz bootkit persistence spyware stealer
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Blocklisted process makes network request
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral7
- Target
  
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.bin
- Size
  
  353KB
- MD5
  
  71b6a493388e7d0b40c83ce903bc6b04
- SHA1
  
  34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
- SHA256
  
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
- SHA512
  
  072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
- SSDEEP
  
  6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
Score

10^/10

mimikatz bootkit persistence spyware stealer
- Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Blocklisted process makes network request
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral8
- Target
  
  myguy.hta
- Size
  
  13KB
- MD5
  
  0487382a4daf8eb9660f1c67e30f8b25
- SHA1
  
  736752744122a0b5ee4b95ddad634dd225dc0f73
- SHA256
  
  ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6
- SHA512
  
  e1e7d81d54efd526139ea8ac792ed2035c8e70f040319c0b65f723431d31077c7a6927553890c99151f2354f51c4020ed94e0e2e5d56386c2fc4828e95869106
- SSDEEP
  
  192:ScIsmNvaHz65bP/U/njs3NH0Z0UvDVE6Az6XVHBycT6iLMUpJ2seCYHlfeb:SPXTmnjs3BU9A27BNLMUTb
Score

3^/10
behavioral9
- Target
  
  svchost.exe
- Size
  
  704KB
- MD5
  
  d2ec63b63e88ece47fbaab1ca22da1ef
- SHA1
  
  dd52fcc042a44a2af9e43c15a8e520b54128cdc8
- SHA256
  
  e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5
- SHA512
  
  89d9e63d5f3b34be3d25317933031815a42c039fbee30ce8c86f8b1b7c6ca9ccfc8731da99b9246381a2c05a95ada423f4944ff72111eb0451a44e9dcb3e053e
- SSDEEP
  
  12288:rue4X2Uz0DsetgxLdsCHvX8XYJWs6XS1bFLDw1P86jZpMV7uikFg:v+2UzSgxLdsCHmQb6XSbFLDs06jZulus
Score

7^/10
- Drops startup file
- Drops desktop.ini file(s)
behavioral10
- Target
  
  Ransomware-master/etc/load.sh
- Size
  
  4KB
- MD5
  
  8f14e34971812277edeb8a31376cb27a
- SHA1
  
  5a96858d0d97ca1e229a1270d1a34a09c3c677ea
- SHA256
  
  1a275cbf23a5a5620d40cda6bd3f621a48d7b2119b2c8bf97b87a97f83933e85
- SHA512
  
  a63a692e0d63944ee9824578b52f7eb41fd9d9f7e3414d22cb3b81f337571f0c8720672866f4f534eb1c7f3c87662b120addff038806363f3ccaf86a69949ca4
- SSDEEP
  
  96:v7fGWJIKNsm/kgrkSYpJhc0P+Z6psE8Gkh+mKuc3nWX5neEpT2:vbdp1fY3hlaG1kh+mjcm4EU
Score

3^/10
behavioral11
- Target
  
  Ransomware-master/test.py
- Size
  
  186B
- MD5
  
  f5c90d7b70869e8de04c7d7e3051dea9
- SHA1
  
  93cf6fd3b58cfa7e9ccb7c88bd2cccd65a4d4be7
- SHA256
  
  4bfe4b8e987cae3539dddec1fc0732a7b1195768f0c8ff3352dccd4fa76bc249
- SHA512
  
  64d5aaaa1bcbb17eff100bc83d1020660b6e4b6734f99bd5017e0d895753b70619bafd63809b72768815ce1ad1cc80fecd41e8414b1498201bd310dfed213d25
Score

3^/10
behavioral12
- Target
  
  Ransomware-master/test2.py
- Size
  
  554B
- MD5
  
  dc42f74575c40fc6c90d73b747df6803
- SHA1
  
  ff5d98b1f959810719299c5fb0042436634b1999
- SHA256
  
  d1f9f5e30ac4d8d5771af930b15a51fb040cb1a2b84c7b7feeebb7e4d5fdc1bb
- SHA512
  
  d4a311676aa16d11f678eaf32e5ee4c18ba2f3beab0d494e09ae6a8214575d5178b9de7126131ad0d5da909594a4e0dbbb791ebed62550b9080cf2a8fb78bb9e
Score

3^/10
behavioral13
- Target
  
  Ransomware-master/warna.py
- Size
  
  650B
- MD5
  
  19522678240a7e6d1e5531ed275b6a64
- SHA1
  
  01653b2ca19505c7e9a7972df2e7d6784cc627b6
- SHA256
  
  6986bfb870797a56611749719d8aabfdfcf272392765692a15c065c42f88c3cf
- SHA512
  
  8f2d1efd81a4bafa8d3a50fce740514469a7ccdb2d68f908b9e86d1714ca605525e75a5f0f5ac9dd798299db75810bdf0d06f88e0103609b4d0843ff12d24292
Score

3^/10
behavioral14