General
-
Target
Cerber5.exe
-
Size
313KB
-
Sample
240404-2elmnace93
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Static task
static1
Behavioral task
behavioral1
Sample
Cerber5.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Cerber5.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___Q82O_.txt
cerber
http://xpcx6erilkjced3j.onion/B391-A06B-7585-0098-B34F
http://xpcx6erilkjced3j.1n5mod.top/B391-A06B-7585-0098-B34F
http://xpcx6erilkjced3j.19kdeh.top/B391-A06B-7585-0098-B34F
http://xpcx6erilkjced3j.1mpsnr.top/B391-A06B-7585-0098-B34F
http://xpcx6erilkjced3j.18ey8e.top/B391-A06B-7585-0098-B34F
http://xpcx6erilkjced3j.17gcun.top/B391-A06B-7585-0098-B34F
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___SXQJW7Z_.txt
cerber
http://xpcx6erilkjced3j.onion/9BD7-81AB-4EC6-0098-BCA0
http://xpcx6erilkjced3j.1n5mod.top/9BD7-81AB-4EC6-0098-BCA0
http://xpcx6erilkjced3j.19kdeh.top/9BD7-81AB-4EC6-0098-BCA0
http://xpcx6erilkjced3j.1mpsnr.top/9BD7-81AB-4EC6-0098-BCA0
http://xpcx6erilkjced3j.18ey8e.top/9BD7-81AB-4EC6-0098-BCA0
http://xpcx6erilkjced3j.17gcun.top/9BD7-81AB-4EC6-0098-BCA0
Targets
-
-
Target
Cerber5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Score10/10-
Contacts a large (1091) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-