cerber | 2c77fa3f45980eb0a3d97b08e186b9c992c43e25df035afaa3f0cc252a4308a3 | Triage

Sharing

General

Target

BetterAimAssist_[unknowncheats.me]_.rar
Size

2.0MB
Sample

250331-1g59eayvdv
MD5

1cfd7f2e1cdb55de63d8083c1ad60837
SHA1

29c19f0bf1a779b7b034226235e3035ed1391413
SHA256

2c77fa3f45980eb0a3d97b08e186b9c992c43e25df035afaa3f0cc252a4308a3
SHA512

2ab9809c37e7715d9f88f04079cfc4e6704444c8234cabf4d9e0a0cad29ca4338d655bcf9445d23509f0ed36cda9c8eeb8f68bfdae79923c3f2f0c9cf7d8aa0a
SSDEEP

49152:z/DEN+RwHEQC6UK1v0bnbukAx7Rx0cW0OPpUVU2Z2:z/YN+Ext0bbufM7UVUt

Score

10^/10

cerber defense_evasion execution ransomware

Malware Config

Targets

- Target
  
  D3DX9_43.dll
- Size
  
  2.3MB
- MD5
  
  7160fc226391c0b50c85571fa1a546e5
- SHA1
  
  2bf450850a522a09e8d1ce0f1e443d86d934f4ad
- SHA256
  
  84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
- SHA512
  
  dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
- SSDEEP
  
  49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW
Score

1^/10
behavioral1
- Target
  
  Frog Spoofer.exe
- Size
  
  2.7MB
- MD5
  
  e001605fa695282a2d3170d8d9e956c9
- SHA1
  
  4544155daae0335ada1d05a509e43b8c0434ffc8
- SHA256
  
  003dc05c74dedfb83f73982173d2ed293a84a2af8a7ef8b6e6ff928119859a2e
- SHA512
  
  11642791791255eea62db5b5058e651329d9b537cc9ffd734702b5bf5207351ecc3bbdb3499acb3dc43e7937da8efd9e23b1e1ccfaa6a077bd747a40926d40d6
- SSDEEP
  
  49152:wy8J1anDS2TFQTnQT2QT9QT1QTXCbAAKrqgvWAtY3o41MBXcOz5dD:CxYw1aCkX23o41MBXc4D
Score

10^/10

cerber defense_evasion execution ransomware
- Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Cerber family
  cerber
- Stops running service(s)
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

behavioral2

cerberdefense_evasionexecutionransomware