cerber

General

Target

Ransomware.Cerber.zip
Size

215KB
Sample

250114-zqv95azke1
MD5

5c571c69dd75c30f95fe280ca6c624e9
SHA1

b0610fc5d35478c4b95c450b66d2305155776b56
SHA256

416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c
SHA512

8e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2
SSDEEP

3072:EJk9kcytz1Qg4kViSMoq9OsLvz8L5HINY8lYdeIX8woWJQHr6LqK2fU0MwL0b06R:EUkcyVlDq8rIblYomoWnvfp0g

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___33C3H4_.txt

Family

cerber

Ransom Note

CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/BBE4-87B6-ECB7-0446-926C Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/BBE4-87B6-ECB7-0446-926C 2. http://p27dokhpz2n7nvgr.14ewqv.top/BBE4-87B6-ECB7-0446-926C 3. http://p27dokhpz2n7nvgr.14vvrc.top/BBE4-87B6-ECB7-0446-926C 4. http://p27dokhpz2n7nvgr.129p1t.top/BBE4-87B6-ECB7-0446-926C 5. http://p27dokhpz2n7nvgr.1apgrn.top/BBE4-87B6-ECB7-0446-926C ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://p27dokhpz2n7nvgr.onion/BBE4-87B6-ECB7-0446-926C

http://p27dokhpz2n7nvgr.12hygy.top/BBE4-87B6-ECB7-0446-926C

http://p27dokhpz2n7nvgr.14ewqv.top/BBE4-87B6-ECB7-0446-926C

http://p27dokhpz2n7nvgr.14vvrc.top/BBE4-87B6-ECB7-0446-926C

http://p27dokhpz2n7nvgr.129p1t.top/BBE4-87B6-ECB7-0446-926C

http://p27dokhpz2n7nvgr.1apgrn.top/BBE4-87B6-ECB7-0446-926C

Targets

- Target
  
  cerber.exe
- Size
  
  604KB
- MD5
  
  8b6bc16fd137c09a08b02bbe1bb7d670
- SHA1
  
  c69a0f6c6f809c01db92ca658fcf1b643391a2b7
- SHA256
  
  e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
- SHA512
  
  b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
- SSDEEP
  
  6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
Score

10^/10

cerber discovery evasion persistence privilege_escalation ransomware
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Cerber family
  cerber
- Blocklisted process makes network request
- Contacts a large (1098) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Windows Firewall
  evasion
- Deletes itself
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1