cerber

General

Target

frog.rar
Size

2.0MB
Sample

250310-tyrzsa1ly8
MD5

8afac0dbececa9a14eb45c46d18f5c99
SHA1

6382481f467c6d2e334249931335f21887b76b07
SHA256

cbe89146c2b5c01173a1faa442841ffd1d8209b2774975b8835dea678f1af84b
SHA512

74f148dc27fff2f914e6a21b5a13f24198e31424039354bd2656ce86f57e895637ecd07e8dd184490f667dc1dae7dd5d981a8790dfc5485f5820e1f538b0b1d8
SSDEEP

49152:1/DEN+RwHEQC6UK1v0bpbukAx7Rx0cW0OPpUVU2ZK:1/YN+Ext0b1ufM7UVUT

Score

10^/10

Malware Config

Targets

- Target
  
  frog/D3DX9_43.dll
- Size
  
  2.3MB
- MD5
  
  7160fc226391c0b50c85571fa1a546e5
- SHA1
  
  2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA256
  
  84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- SHA512
  
  dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP
  
  49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
Score

1^/10
behavioral1 behavioral2
- Target
  
  frog/Frog Spoofer (1).exe
- Size
  
  2.7MB
- MD5
  
  e001605fa695282a2d3170d8d9e956c9
- SHA1
  
  4544155daae0335ada1d05a509e43b8c0434ffc8
- SHA256
  
  003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e
- SHA512
  
  11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6
- SSDEEP
  
  49152:wy8J1anDS2TFQTnQT2QT9QT1QTXCbAAKrqgvWAtY3o41MBXcOz5dD:CxYw1aCkX23o41MBXc4D
Score

10^/10

cerber defense_evasion discovery execution ransomware
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Cerber family
  cerber
- Stops running service(s)
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral3 behavioral4