cerber

General

Target

RNSM00284.7z
Size

13.9MB
Sample

241119-w8z49azdlh
MD5

e20f6ad9e266cbabca31feedc697cfa5
SHA1

be955cbc02286ea800dd11887f63a624a25a8013
SHA256

312fdde51aed90d23843d50649032290c89b8af4661d61f5baa032b03ba870db
SHA512

112fcb80fa932efe1bf09cdf7c32350634e3ab6ed1ceb0ce66fed93830ecc47b7397b5d404cc2d20dad8368ddbd4c0d25d11b4dd144d46ecad4963ef893f58ab
SSDEEP

393216:vzae+bw+rVeYq6BywWZSh7T3M6ZEWu8inEOiCR+zqQ97r6oaKh:qBBdq60wWE1E5bjiCR+zqQ97r6oa6

Score

10^/10

Malware Config

Targets

- Target
  
  RNSM00284.7z
- Size
  
  13.9MB
- MD5
  
  e20f6ad9e266cbabca31feedc697cfa5
- SHA1
  
  be955cbc02286ea800dd11887f63a624a25a8013
- SHA256
  
  312fdde51aed90d23843d50649032290c89b8af4661d61f5baa032b03ba870db
- SHA512
  
  112fcb80fa932efe1bf09cdf7c32350634e3ab6ed1ceb0ce66fed93830ecc47b7397b5d404cc2d20dad8368ddbd4c0d25d11b4dd144d46ecad4963ef893f58ab
- SSDEEP
  
  393216:vzae+bw+rVeYq6BywWZSh7T3M6ZEWu8inEOiCR+zqQ97r6oaKh:qBBdq60wWE1E5bjiCR+zqQ97r6oa6
Score

10^/10

cerber gozi locky troldesh banker collection defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Cerber family
  cerber
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
- Locky
  Ransomware strain released in 2016, with advanced features like anti-analysis.
  ransomware locky
- Locky family
  locky
- Troldesh family
  troldesh
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Contacts a large (1111) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1