Overview

overview

10

Static

static

1

Badware Unban.zip

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Badware Unban.zip

  • Size

    32.7MB

  • Sample

    240724-tdv6psvajp

  • MD5

    1042c5c00030fdf20bc00f3912970ec3

  • SHA1

    e383bd53a4736d05bd7aa2954c94294e9a36410f

  • SHA256

    f9ca19c8fa421287522b0606e25a97b0e6f9a6737d0021813da685a36d3151de

  • SHA512

    99a140cfc7fa2d84f437ba943a2e3fa936d42232eeb2984f28a6c1bdff2587b733367ec85b496064cbfcb8d84c37c81191ddd936356e629660d1fccb0eb01312

  • SSDEEP

    786432:Cvn5q4e/trW377C0tsXkF9V8/KYwdGmKeBxaW2kdK7SUqXyBINW0:CvngVEIkHoKLdGmKeskA7SUqCQW0

Score
10/10
cerberdiscoveryransomware

Malware Config

Targets

    • Target

      Badware Unban.zip

    • Size

      32.7MB

    • MD5

      1042c5c00030fdf20bc00f3912970ec3

    • SHA1

      e383bd53a4736d05bd7aa2954c94294e9a36410f

    • SHA256

      f9ca19c8fa421287522b0606e25a97b0e6f9a6737d0021813da685a36d3151de

    • SHA512

      99a140cfc7fa2d84f437ba943a2e3fa936d42232eeb2984f28a6c1bdff2587b733367ec85b496064cbfcb8d84c37c81191ddd936356e629660d1fccb0eb01312

    • SSDEEP

      786432:Cvn5q4e/trW377C0tsXkF9V8/KYwdGmKeBxaW2kdK7SUqXyBINW0:CvngVEIkHoKLdGmKeskA7SUqCQW0

    Score
    10/10
    cerberdiscoveryransomware

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks