Overview

overview

10

Static

static

3

NkPrivateSpoofer.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NkPrivateSpoofer.zip

  • Size

    5.1MB

  • Sample

    241125-a4xbxavkcq

  • MD5

    470d2096c4711d3d8c5e0be84f6b520b

  • SHA1

    8ff56896ea5b64d3d261fc973140bd0a52fa1dca

  • SHA256

    a563e7ac52ec2d7d734d61662bcc054860e39572db91d4482b237f6472d85f3d

  • SHA512

    6dca3561e8a78ed8c26685ad59559ee762a7d527d26d37a497b49685621624603c883a65820f2ab551a8bc3026d5262e0524a8c0a248024f0741bb62ddbb508e

  • SSDEEP

    98304:i2NJXbaCQCBCjAVE0vAdt+vtduiOC8on5Q2Nbp6WWr5jT4tuaGBREAoF+eb:iKXbDQLsVUdt+Vd/nJNbpBW9jUt/GBRs

Score
10/10
cerberdiscoverypersistenceransomware

Malware Config

Targets

    • Target

      NkPrivateSpoofer.zip

    • Size

      5.1MB

    • MD5

      470d2096c4711d3d8c5e0be84f6b520b

    • SHA1

      8ff56896ea5b64d3d261fc973140bd0a52fa1dca

    • SHA256

      a563e7ac52ec2d7d734d61662bcc054860e39572db91d4482b237f6472d85f3d

    • SHA512

      6dca3561e8a78ed8c26685ad59559ee762a7d527d26d37a497b49685621624603c883a65820f2ab551a8bc3026d5262e0524a8c0a248024f0741bb62ddbb508e

    • SSDEEP

      98304:i2NJXbaCQCBCjAVE0vAdt+vtduiOC8on5Q2Nbp6WWr5jT4tuaGBREAoF+eb:iKXbDQLsVUdt+Vd/nJNbpBW9jUt/GBRs

    Score
    10/10
    cerberdiscoverypersistenceransomware

    • Cerber

      Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

      ransomwarecerber

    • Cerber family

      cerber

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks