cerber | 8b9c7147b7a4e4cfa31028792536bad9ae4df1c216de52d9e366628a92e4895e

General

Target
8b9c7147b7a4e4cfa31028792536bad9ae4df1c216de52d9e366628a92e4895e.bin.zip
Size 183KB
Sample260930-m9bzdadg44
SHA256 8b9c7147b7a4e4cfa31028792536bad9ae4df1c216de52d9e366628a92e4895e
MD5 d4c91f0dd0b17ccd1fac79f2f603ff49
SHA1 c8a235eaa839ce37abeda9899450edd9d2aa5d6d
SHA512 54beb5ec7cb8773724623fba92efb018b9ac50738da2ec1eb50f9933481d39e16c2ba8683e8ca9b3b3c5edb6e85abd4c14a1953edecfd06de2304de64ad99861
SSDEEP 3072:4JUN0S8RMyF2iTBet/NSnnfMKPdrsvdDGO7Vj5pLVqC6qEeqeqEUslwbhgmYN:4JUN0tMyFRENNCfM8B4DG059v6q9f/wK
TLSH
T18404224F2EA06163970836958F8CBFB78A89895A764D8C3B63DDCE14DD54230F584E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___ZPIXH8_.txt

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/A718-5AF5-CDB7-0098-B7B3 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/A718-5AF5-CDB7-0098-B7B3 2. http://xpcx6erilkjced3j.19kdeh.top/A718-5AF5-CDB7-0098-B7B3 3. http://xpcx6erilkjced3j.1mpsnr.top/A718-5AF5-CDB7-0098-B7B3 4. http://xpcx6erilkjced3j.18ey8e.top/A718-5AF5-CDB7-0098-B7B3 5. http://xpcx6erilkjced3j.17gcun.top/A718-5AF5-CDB7-0098-B7B3 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/A718-5AF5-CDB7-0098-B7B3
http://xpcx6erilkjced3j.1n5mod.top/A718-5AF5-CDB7-0098-B7B3
http://xpcx6erilkjced3j.19kdeh.top/A718-5AF5-CDB7-0098-B7B3
http://xpcx6erilkjced3j.1mpsnr.top/A718-5AF5-CDB7-0098-B7B3
http://xpcx6erilkjced3j.18ey8e.top/A718-5AF5-CDB7-0098-B7B3
http://xpcx6erilkjced3j.17gcun.top/A718-5AF5-CDB7-0098-B7B3

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___8Q555_.txt

cerber

Ransom Note

Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/DF9D-6E7C-72B3-0098-BF85 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/DF9D-6E7C-72B3-0098-BF85 2. http://xpcx6erilkjced3j.19kdeh.top/DF9D-6E7C-72B3-0098-BF85 3. http://xpcx6erilkjced3j.1mpsnr.top/DF9D-6E7C-72B3-0098-BF85 4. http://xpcx6erilkjced3j.18ey8e.top/DF9D-6E7C-72B3-0098-BF85 5. http://xpcx6erilkjced3j.17gcun.top/DF9D-6E7C-72B3-0098-BF85 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----

URLs

http://xpcx6erilkjced3j.onion/DF9D-6E7C-72B3-0098-BF85
http://xpcx6erilkjced3j.1n5mod.top/DF9D-6E7C-72B3-0098-BF85
http://xpcx6erilkjced3j.19kdeh.top/DF9D-6E7C-72B3-0098-BF85
http://xpcx6erilkjced3j.1mpsnr.top/DF9D-6E7C-72B3-0098-BF85
http://xpcx6erilkjced3j.18ey8e.top/DF9D-6E7C-72B3-0098-BF85
http://xpcx6erilkjced3j.17gcun.top/DF9D-6E7C-72B3-0098-BF85

Targets

- Target
  Cerber5.exe
- Size 313KB
- SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
- MD5 fe1bc60a95b2c2d77cd5d232296a7fa4
- SHA1 c07dfdea8da2da5bad036e7c2f5d37582e1cf684
- SHA512 266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
- SSDEEP 6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
- TLSH
  T19F645BC3BAA883CBDD2D43BA12B41F3EBC499E24158F9449D1D4C8D4D98E73278766C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution cerber persistence privilege_escalation ransomware
- Family: Cerber
  Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
  ransomware cerber
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts a large (1107) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2