General
-
Target
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
-
Size
604KB
-
Sample
191030-74m7ldmwsn
-
MD5
8b6bc16fd137c09a08b02bbe1bb7d670
-
SHA1
c69a0f6c6f809c01db92ca658fcf1b643391a2b7
-
SHA256
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
-
SHA512
b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
Task
task1
Sample
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
Resource
win7v191014
Malware Config
Extracted
\??\c:\users\admin\documents\_R_E_A_D___T_H_I_S___FLDL9_.txt
cerber
http://p27dokhpz2n7nvgr.onion/A630-0910-E3A4-0446-9808
http://p27dokhpz2n7nvgr.12hygy.top/A630-0910-E3A4-0446-9808
http://p27dokhpz2n7nvgr.14ewqv.top/A630-0910-E3A4-0446-9808
http://p27dokhpz2n7nvgr.14vvrc.top/A630-0910-E3A4-0446-9808
http://p27dokhpz2n7nvgr.129p1t.top/A630-0910-E3A4-0446-9808
http://p27dokhpz2n7nvgr.1apgrn.top/A630-0910-E3A4-0446-9808
Extracted
\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___G7H1IS_.txt
cerber
http://p27dokhpz2n7nvgr.onion/3C50-CE8C-AA7E-0446-992E
http://p27dokhpz2n7nvgr.12hygy.top/3C50-CE8C-AA7E-0446-992E
http://p27dokhpz2n7nvgr.14ewqv.top/3C50-CE8C-AA7E-0446-992E
http://p27dokhpz2n7nvgr.14vvrc.top/3C50-CE8C-AA7E-0446-992E
http://p27dokhpz2n7nvgr.129p1t.top/3C50-CE8C-AA7E-0446-992E
http://p27dokhpz2n7nvgr.1apgrn.top/3C50-CE8C-AA7E-0446-992E
Targets
-
-
Target
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe
-
Size
604KB
-
MD5
8b6bc16fd137c09a08b02bbe1bb7d670
-
SHA1
c69a0f6c6f809c01db92ca658fcf1b643391a2b7
-
SHA256
e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
-
SHA512
b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24
-
Cerber core protection mutex and taskkill behavior
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Sets desktop wallpaper using registry
-