Overview

overview

10

Static

static

7

Neuer Ordn....1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Neuer Ordner (2).rar

  • Size

    5.4MB

  • Sample

    241117-zh6e5aybln

  • MD5

    600afdc518236c94e2e383218a79a648

  • SHA1

    7432c9c42c2d7bd74ef33b08f6cbf385bd6335f8

  • SHA256

    d9994356922ae90e1715086a2d5f5cb110ff0bc432509bcd7528cb70fb1becec

  • SHA512

    2a6408535749d2d2a0911286ef941078d01be128918a75f789bbefd8d2a17b13de177842fa6eb0a35af23d85f73e209bc042ac97fa960c7561d4a3f4ae4e6a5d

  • SSDEEP

    98304:02iPaBLNt4Crn13KT+WYGiSyQxDMxm4VAVyj104Sn5vDkA3F9p4bK0kDwabtsXjK:4MJt4CrncTIGiSZmxm7m104E5vDnj4kz

Score
10/10
cerberdiscoveryransomwarevmprotect

Malware Config

Targets

    • Target

      Neuer Ordner (2)/AV-Permanent-V2.1.exe

    • Size

      5.8MB

    • MD5

      2e39c7ee4f32bdb56637fa5e2979eacc

    • SHA1

      7df4429c131043c66fea6ea8ba5b5caf8940d3b3

    • SHA256

      4b4631d6e8dec4234941dfbb302ccb9f9ac83d9a015da5e1532347614c25b42e

    • SHA512

      a6209e7c855a17594645a31cf4732e8a15ae1b4313fabbdc1f07fd5806e1cb007d3c8d88b5d08836502841403e4a86c0b248bac87208448c5026edcb9dc52ddc

    • SSDEEP

      98304:trN/fXVWhV51qwU/ummzAB+l4JVite6XRGK2wtV6hyf0luLl:lNHABowAurABHiLGK2mV6hs0lg

    Score
    10/10
    cerberdiscoveryransomwarevmprotect

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Cerber family

      cerber

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks