General
-
Target
Cerber5.bin
-
Size
313KB
-
Sample
240129-gmffdsdacp
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Static task
static1
Behavioral task
behavioral1
Sample
Cerber5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Cerber5.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5KCDFZ_.txt
cerber
http://xpcx6erilkjced3j.onion/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.1n5mod.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.19kdeh.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.1mpsnr.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.18ey8e.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.17gcun.top/FEA4-8D4F-A8C7-0098-B25D
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___BE03TG_.txt
cerber
http://xpcx6erilkjced3j.onion/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.1n5mod.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.19kdeh.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.1mpsnr.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.18ey8e.top/3A12-33FD-03F2-0098-B746
http://xpcx6erilkjced3j.17gcun.top/3A12-33FD-03F2-0098-B746
Targets
-
-
Target
Cerber5.bin
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Score10/10-
Blocklisted process makes network request
-
Contacts a large (1095) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-