jaffacakes118_Trojan-Ransom[.]Win32[.]Zerber[.]czzb[.]9b7b817d889122ce8c2107122277d1fc

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.9b7b817d889122ce8c2107122277d1fc
Size 280KB
Sample261016-e17exs1y9q
SHA256 708980062f0a75ede8f46ca9e329f05998859f5638b99cde579f2d07e5148e1c
MD5 9b7b817d889122ce8c2107122277d1fc
SHA1 cb1e9e73ec67ade98304bcae452518758bde91d6
SHA512 585ee6fbe9d8a32fbc0e167e7a3ae030213153c4e5ab755155bcaff0da5486a64152b68a6ce0e4b0c28736a9fe2a518fd45c752905d1d52ff763f20ef5aae041
SSDEEP 6144:T28A9pFotl2z1zkO+BK+ov0eo6BLpn6wyauOi6ZkY6D:y8Ga/2z1z9hdv06XyauH6OX
TLSH
T100541251A9F394E7EA6E867115B35070DBB3E91442268ACF33284F7B3C70F851A0B647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.9b7b817d889122ce8c2107122277d1fc
unpack001/$PLUGINSDIR/System.dll
unpack001/scarcement.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.9b7b817d889122ce8c2107122277d1fc

.exe 280KB
$PLUGINSDIR/System.dll

.dll 11KB
Nervine.bin

174KB
scarcement.dll

.dll 180KB

jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.9b7b817d889122ce8c2107122277d1fc

IMPHASH bd1dc23681f44e733e87b20cf5b908b7
SHA256 708980062f0a75ede8f46ca9e329f05998859f5638b99cde579f2d07e5148e1c
MD5 9b7b817d889122ce8c2107122277d1fc
SHA1 cb1e9e73ec67ade98304bcae452518758bde91d6
SHA512 585ee6fbe9d8a32fbc0e167e7a3ae030213153c4e5ab755155bcaff0da5486a64152b68a6ce0e4b0c28736a9fe2a518fd45c752905d1d52ff763f20ef5aae041
SSDEEP 6144:T28A9pFotl2z1zkO+BK+ov0eo6BLpn6wyauOi6ZkY6D:y8Ga/2z1z9hdv06XyauH6OX
TLSH
T100541251A9F394E7EA6E867115B35070DBB3E91442268ACF33284F7B3C70F851A0B647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep SetFileAttributesA GetFileAttributesA GetTickCount GetFileSize GetModuleFileNameA ReadFile CreateFileA GetCurrentProcess ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA GetVersion SetErrorMode ExpandEnvironmentStringsA CopyFileA GetFullPathNameA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA LoadLibraryA GetProcAddress lstrcmpiA lstrcmpA SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA CloseHandle SetFileTime GetDiskFreeSpaceA lstrlenA lstrcpynA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar MulDiv WritePrivateProfileStringA FreeLibrary LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetWindowLongA SetForegroundWindow ShowWindow IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
TLSH
T1F9324C15135046F3E1D2853C242B3AAB6FB869118AF04E43CFB36852EF386C6AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

scarcement.dll

IMPHASH d19f2340440a1e446e408882739b1acc
SHA256 fa294502d4967b110f50ade46b46f127a87dcd5476f7bada8176e5add4a6da61
MD5 aeff6b2886b3668781b4a76a07428638
SHA1 838ac9b41483e3473d3a2e5734f1edf494227208
SHA512 f53cfbc428098d316bc624be043275a7f75db18cbdff722a09ad8a1895ca46612c4a17b5971efe1eb47d6a7ea22f9c857cf46ac9c6f5dfd0f7efdee460cffa7f
SSDEEP 3072:40694SH74APdILu/5z3phHLWfvfLuWDPWnolOcckBG/VGpjPtmOvpS:4H9tb4AIu/V3pevDuWDP3lOSUO
TLSH
T119043B00B650C03CF9BF01FD95F5879CE82A3A70EBAD85CB62E2599A16791E4ED31353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

15968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

GetClientRect

kernel32

GetACP GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapValidate IsBadReadPtr ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA UnhandledExceptionFilter TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW RtlUnwind GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection HeapReAlloc VirtualAlloc WriteFile LoadLibraryA InitializeCriticalSection MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW LCMapStringA LCMapStringW RaiseException SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers

jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.9b7b817d889122ce8c2107122277d1fc

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Nervine.bin

scarcement.dll

user32

kernel32

generic