Extracted

• • Target
    sample
  • Size 295KB
  • SHA256 301d2453a8ed8669c59a099b7feda36c4e00180bc101ea9c694d4e7ad57590b6
  • MD5 1ac3d69c628d84283778b3d9c9a704a6
  • SHA1 59576d9428842f7cd2866cecf33792ac22b8ab15
  • SHA512 843f43dc9ae2abd3744113ad39bb701507a7f5ba2184cb5519404fc8a98b91ac454a379bee24c81877e0f12e63564442e16a09b567089c38fda6e98a193083e2
  • SSDEEP 3072:it3A2zqx3AAI7mJSYrl3/7Fg3Vmb/Mr6TIbWXdhy52T7XA:it3A2zqdzI7mJn/7FKmbRTIm7T7w
  • TLSH
    T17D546B72A200B13BA523DEA0A6BF7F4E3C35E12BDC1646F86591E530CFE2EB1051665D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutioncerberpersistenceprivilege_escalationransomware

  • Family: Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Contacts a large (1149) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1