Overview

overview

10

Static

static

3

HwidWoofer.exe

windows7-x64

10

HwidWoofer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HwidWoofer.exe

  • Size

    37KB

  • Sample

    240317-vzg2msbb73

  • MD5

    56956f15efc4b5c32c5b29c26f043c26

  • SHA1

    5d8936716e7735235618fe2c8c8d813f3fab9684

  • SHA256

    e45a223e95e8fbae17daa2b587f400231b720dfeaa30086bade38a2e0c037cd8

  • SHA512

    b17406525d45dc938ccb24a6e7ac8388970e477d8c8b1863a5743af671a514d0772662a0fdf700898a55852e2710540b80b3a42990f9df813399daf66a2d01aa

  • SSDEEP

    768:sWAyP38owL450RzHkAklLHp5zekO39cG:yykoAvRzEPLjsc

Score
10/10
cerberevasionransomware

Malware Config

Targets

    • Target

      HwidWoofer.exe

    • Size

      37KB

    • MD5

      56956f15efc4b5c32c5b29c26f043c26

    • SHA1

      5d8936716e7735235618fe2c8c8d813f3fab9684

    • SHA256

      e45a223e95e8fbae17daa2b587f400231b720dfeaa30086bade38a2e0c037cd8

    • SHA512

      b17406525d45dc938ccb24a6e7ac8388970e477d8c8b1863a5743af671a514d0772662a0fdf700898a55852e2710540b80b3a42990f9df813399daf66a2d01aa

    • SSDEEP

      768:sWAyP38owL450RzHkAklLHp5zekO39cG:yykoAvRzEPLjsc

    Score
    10/10
    cerberevasionransomware

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Downloads MZ/PE file

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks