Ransomware[.]Cerber[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Ransomware.Cerber.zip
Size 215KB
Sample241018-w68zdatfjm
SHA256 416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c
MD5 5c571c69dd75c30f95fe280ca6c624e9
SHA1 b0610fc5d35478c4b95c450b66d2305155776b56
SHA512 8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2
SSDEEP 3072:EJk9kcytz1Qg4kViSMoq9OsLvz8L5HINY8lYdeIX8woWJQHr6LqK2fU0MwL0b06R:EUkcyVlDq8rIblYomoWnvfp0g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cerber.exe

File Explorer

Ransomware.Cerber.zip

.zip 215KB
cerber.exe

.exe 604KB

Ransomware.Cerber.zip

SHA256 416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c
MD5 5c571c69dd75c30f95fe280ca6c624e9
SHA1 b0610fc5d35478c4b95c450b66d2305155776b56
SHA512 8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2
SSDEEP 3072:EJk9kcytz1Qg4kViSMoq9OsLvz8L5HINY8lYdeIX8woWJQHr6LqK2fU0MwL0b06R:EUkcyVlDq8rIblYomoWnvfp0g
MD5 SHA1 SHA512 SSDEEP

Password

infected

cerber.exe

IMPHASH 9d6ed8d049bc10bc45b1995cb6f7f4b6
SHA256 e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
MD5 8b6bc16fd137c09a08b02bbe1bb7d670
SHA1 c69a0f6c6f809c01db92ca658fcf1b643391a2b7
SHA512 b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
SSDEEP 6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

324832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSize GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetSystemTime GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadLocale GetTickCount GetTimeFormatW GetUserDefaultLCID GetVersion GetVersionExA GetVolumeInformationW GetWindowsDirectoryW Heap32ListFirst HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InterlockedDecrement InterlockedIncrement IsSystemResumeAutomatic LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MoveFileExA MoveFileExW MoveFileW MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceCounter QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory RemoveDirectoryW ScrollConsoleScreenBufferW SearchPathW SetConsoleCtrlHandler SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime SetLastError SetLocalTime SetSystemTime SetThreadLocale SetUnhandledExceptionFilter SetVolumeLabelA SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TransmitCommChar UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualFreeEx VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileSectionA _hwrite lstrcmpW lstrcmpiW lstrcpyW lstrlenW GetEnvironmentStringsW GetDriveTypeW GetDiskFreeSpaceExW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryW GetConsoleTitleW GetConsoleScreenBufferInfo GetConsoleOutputCP GetConsoleMode GetCompressedFileSizeW GetCommandLineW GetCPInfo GetBinaryTypeW GetBinaryType FreeLibrary FormatMessageW FlushFileBuffers FlushConsoleInputBuffer FindNextFileW FindNextFileA FindFirstFileW FindFirstFileA FindClose FillConsoleOutputCharacterW FillConsoleOutputAttribute FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsW EraseTape EnterCriticalSection DuplicateHandle DeleteFileW DeleteFileA CreateThread CreateProcessW CreateFileW CreateFileA CreateDirectoryW CopyFileW CopyFileA ConvertDefaultLocale CompareFileTime CloseHandle OpenProcess AddAtomW

user32

DefWindowProcW DrawFocusRect CreateWindowStationA CreateMenu FillRect FindWindowW GetMenuCheckMarkDimensions GetProcessWindowStation GetSysColorBrush GetThreadDesktop GetUpdateRgn GetUserObjectInformationW InflateRect InsertMenuItemW IsIconic LockWindowUpdate MessageBeep MessageBoxW MonitorFromWindow OffsetRect PostMessageW RealGetWindowClass SendMessageW SetUserObjectInformationW ShowWindow ToUnicode WinHelpA LoadCursorW GetKBCodePage DefMDIChildProcW CloseWindowStation

gdi32

StartPage SetMiterLimit SetMapperFlags SetBitmapBits PtVisible OffsetClipRgn GetViewportOrgEx GetTextFaceW AddFontMemResourceEx AnimatePalette Arc BRUSHOBJ_pvAllocRbrush ColorMatchToTarget CopyEnhMetaFileA CreatePatternBrush DescribePixelFormat EngFreeModule EngTextOut EnumFontsW FillRgn GdiGetPageCount GetGlyphOutlineW GetMiterLimit GetOutlineTextMetricsA

advapi32

RegOpenKeyW SaferRecordEventLogEntry SaferIdentifyLevel SaferComputeTokenFromLevel SaferCloseLevel RevertToSelf RegSetValueW RegSetValueExW RegQueryValueW RegQueryValueExW CreateProcessAsUserW RegOpenKeyExW RegEnumKeyW RegDeleteKeyW RegCreateKeyExW RegCloseKey LookupAccountSidW ImpersonateLoggedOnUser GetSecurityDescriptorOwner GetFileSecurityW FreeSid

shell32

ShellExecuteExW ShellExecuteA ShellAboutA SHIsFileAvailableOffline SHGetSettings CheckEscapesW DragQueryFile DragQueryFileAorW ExtractIconExW SHAppBarMessage SHBrowseForFolderA SHChangeNotify SHCreateProcessAsUserW SHEmptyRecycleBinA SHFileOperationA SHGetDataFromIDListA SHGetDiskFreeSpaceA SHGetMalloc WOWShellExecute

shlwapi

StrCmpNW StrStrIA StrStrIW StrCmpNA StrChrIA

comctl32

ImageList_Create

msvcrt

_XcptFilter __getmainargs __initenv __p__commode __p__fmode __set_app_type __setusermatherr _adjust_fdiv _c_exit _cexit _close _controlfp _dup _dup2 _errno _except_handler3 _exit _get_osfhandle _getch _initterm _iob _open_osfhandle _pclose _pipe _seh_longjmp_unwind _setjmp3 _setmode _snwprintf _tell _ultoa _vsnwprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wpopen _wtol calloc exit fflush fgets fprintf free iswalpha iswdigit iswspace iswxdigit longjmp malloc memmove printf qsort rand realloc setlocale srand swprintf swscanf time towlower towupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsncpy wcsrchr wcsspn wcsstr wcstol wcstoul