Overview

overview

10

Static

static

3

FrozenV14....ED.exe

windows7-x64

1

FrozenV14....ED.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FrozenV14.6_CRACKED.exe

  • Size

    784KB

  • Sample

    240611-v2swxsvdja

  • MD5

    a03e955ff8ce7abebaf75fe5605417bc

  • SHA1

    c174abdd8d3e28c6c7d2c6ab25620dfd9c082489

  • SHA256

    9855281ee3c8f883115d385b26bef2bd202c4f111bbf4cb3a10b751ab3d08211

  • SHA512

    796ce5aa876771de2814c863ed433441f20ba9f3f2090eea22f0a4b581b4f40fbc6d27f8dde06a277ff29423cb19ce9d79b0756c80ad9dea633399d8172a81b9

  • SSDEEP

    12288:mijyh17Ln+wwu2LjKDYsXCuQN/MGHaF9Ev2U3u:+h1Xnf4jcYsSpMGHaEv2uu

Score
10/10
cerberevasionexecutionransomware

Malware Config

Targets

    • Target

      FrozenV14.6_CRACKED.exe

    • Size

      784KB

    • MD5

      a03e955ff8ce7abebaf75fe5605417bc

    • SHA1

      c174abdd8d3e28c6c7d2c6ab25620dfd9c082489

    • SHA256

      9855281ee3c8f883115d385b26bef2bd202c4f111bbf4cb3a10b751ab3d08211

    • SHA512

      796ce5aa876771de2814c863ed433441f20ba9f3f2090eea22f0a4b581b4f40fbc6d27f8dde06a277ff29423cb19ce9d79b0756c80ad9dea633399d8172a81b9

    • SSDEEP

      12288:mijyh17Ln+wwu2LjKDYsXCuQN/MGHaF9Ev2U3u:+h1Xnf4jcYsSpMGHaEv2uu

    Score
    10/10
    cerberevasionexecutionransomware

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Downloads MZ/PE file

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks