W�oࣉ����H�}�`���W�N�����N�D�z��R���rHP�� �b�ļ�IA}��*��|��]+��(Ƴ5�4fzr"e���!�q�8���a�t2�����*.U�{���Bf���&C��e)�%v?������"�y��#���|3��m�^� 1�F�"�`���vIk|����rKs��>Z�N��̜0�Dp����%�*<N:����g� (�s����<)�ԙ`�k�7vozq77+���1���J�{�W��k+=�G���ˠv��@ŵd� ���OLѻ��x" ��z3��s�ggr��K���پ5�;��G2M�_�g͡5���8�vu1)�� �����w/�%��(j��-B���lV1/G_�B_�ˊ��MW�Q:o��o�2iu_�I1O��LL^�� �� Q�y s�k.�G���%V��i��3��� ��?F��A?[�@�_j<��N�u�=2��I7 /kpGm�Nj�r��h�(���I ����_"B��pJ���8��I��<AQ��!�:�Ā{����>��1��'�Р@�4b�^,�j������l�@�qe��$�D�8�Ě��vʞ�<������Y���h���F�q����e�A$=d�y�^M��%"����8�f�[n#ntϾw)EM�;�7���%Z�Li�۰))8(՚�IG<� E�%�S������>��q�t��F~?Y���Y� O>�R��&��%�9}�q�A�|k ��S0@��*���G�U%��U�OZ_����>b\ ��4��ٛ�3�y\���re��6Q���*#�rS�o������"5q�O�muӹ0E����0����~��{����Y)��~�_�?6+�pdBg��i�eZ��V�S%NΚDUOil�!�ו�� ��ߢ�SY/���Q<���W�`6jsBLo�>��f�������V}�L0[�d�o�ꪳ�,��U4"�l+k?!h� `R�����[6��&#�8�6>p��� ���Nڎ�t�}�R�-�&x���6�j���3���z{��".-7w�\�:qƁ��K��Vk��XJ>���&����hD�s���1��{�h�ߛ�b7qd��qh�l��(��m�d�|N#a[W����3�6!� /�����ljU�X���im�����;\�M[�%�ls�:^���slK���Y���t\xw�� ht-U���K�EW[j�.��]u:G�p:�����Z���~^B����ޮ..�'6�{� �����+�2�k���GI��cT�����[z(���v{�B..�_������A�}F���}Q�8�e:RS�[�e߹(/ �9pWR�2�D��R֞cNz�b�W�k~Ό%���t`�чR����,y�S��!��_��D��EE�Oz&(�Rc�M k�"E�2kX�e��M8'����|�l�z��t4*xG�/�#5�@�v��}�?���l&��E�� �6V����?k��Ku��<^D��1��n���!�#nI�;tC���,���t;?���^���T�*X�ul�i�`̭��ߟ�|e�'C�� x�^����?Vd�B���C��dQ���Zk'�W�$�ϗ�/ٕX���xZ�[L�B���[���μH��ߟl _eZ��:B1.�͢�[� �{���םu20��T�r�������{ ��G(7�S�����"?I��,��E�Ǫ�\�����*��b�^O�gh1:i��)$���B����G��&��C�>�;9U���V~}߅��i�+#��b�u#7:z�o���9O)*��R%4��H��O�P%��.M�ro^^?f H�����k.V��'5�T܌s��|p�өg�,?%���Q�D6��>~rQəCY���T���f�:� z�V���e32蠹r�}�ߚqa�-����3��dU�����&�y���=��.��D�����P�vel4F�2�gÚ�܃��;HA�t�k��QexO�њRKt�a2��-���}$����X)�+N H}ד���e���Cƛ;�).�#��"���ɾ1]1˗�� ����rÕ3��-�O�-"_Jum#��7b�h�����܆N�E��lm��q݇��4��H%�*��c��,���R�x[�I�y$L�M����US��p�*�C����_�.���5��`}���l���-1%&��ϟH�������/t�O.������� �PA���v(=v�����# �Ł:8K��XX놌=�FNټv�R��_��חh��8j�*���u�c��S9.�Qv|��z�S��B^FO��I��d[���a!�)����z�o�wˊ=-�� M�pʘ��g=�=h���a0?�Δ�< DPP�[ u�Qo����H��i�6��e^G�����Si-��uKr9ڈ�{XL�T�p�[�h�hK��xcA�*_�K�*�\3�S�?/�^$�6D�Qiخm��=�nNEy������x�)�+�hOl�=`�^5��8 ^٭���A�$E���+i�}*��O�(7%��T!�{��=��>���*J��g���LB�III��a���g��f4�; 3�<xn�W>Og1/�7v�D_�X�_<&�m;��X�1�[�i��F�7 ����ObE��/�W���˅�r� ����FNĝ�G���O=��C�*.�O���b�Ҝn��,�w���Ə�,,d���N��A�<���VZZ�����I&�����C�`�`]�n�����4�ps�/U��|��i�� �ғ�]A5$��p��������g����Z���GAw���M:�o�5@�oYg�a��Be�+�3��SM��_�S�F<D�S��"��8�`��e"��s^#�\$�Geٙ�j���B��QD��a�[��n���,�5*�P!�J�ٞ���>����ѢtUv87��9�����i�V6cI09�W�w�������L&i1Y��s����hꔑ�b�I�PO�Qe<�A�ka�E�jg1!��� �2q �5u#|I�>�V��&�o�i����K�I��%�-6Ah��vK�D��̂C"��zo� ������7���A��ˤ�d6�F����a �8�0D)�5D Ҝ�8"<���J��S�o�����H
Static task
static1
Behavioral task
behavioral1
Sample
1Bypass Cerberus Vip.exe
Resource
win10v2004-20240802-en
General
-
Target
1Bypass Cerberus Vip.exe
-
Size
51.7MB
-
MD5
8c9c363e197dd8576b5f678627e9e053
-
SHA1
67d60f5579b77d8c873b91e7588285d62dcf4567
-
SHA256
e61fc2d24184ce458c0e8b4ac953292af853bc5adbd4fb22f7cfe59f8a685696
-
SHA512
a8460c891a27cba2a7338c78dff2de0c1b55658d9d90e67994ee745ccd57270c9d3d3974b1f259584fed9947e80ae4ed91060970a1a94fbca79abb4c3e4eb98e
-
SSDEEP
1572864:89ZMpkQ+/9cnGweinZ+b/tE5j6cQPtjs:+kkt89Z+65j6cQFjs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1Bypass Cerberus Vip.exe
Files
-
1Bypass Cerberus Vip.exe.exe windows:6 windows x64 arch:x64
aa1d0c47e215e972b45f662c28385fa8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetProcessId
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateRectRgn
advapi32
RegSetValueExA
shell32
ShellExecuteA
msvcp140d
?__ExceptionPtrRethrow@@YAXPEBX@Z
wtsapi32
WTSEnumerateProcessesW
normaliz
IdnToAscii
wldap32
ord301
crypt32
CryptQueryObject
ws2_32
htons
urlmon
URLDownloadToFileA
imm32
ImmGetContext
dwmapi
DwmEnableBlurBehindWindow
httpapi
HttpCreateUrlGroup
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140d
__std_type_info_destroy_list
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
fseek
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.'I` Size: - Virtual size: 74.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.I*i Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.~`% Size: 51.6MB - Virtual size: 51.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ