Resubmissions

30-10-2019 18:36

191030-74m7ldmwsn 0

29-10-2019 13:10

191029-64114c38xs 0

29-10-2019 10:11

191029-6b3w5klcns 0

General

  • Target

    e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe

  • Size

    604KB

  • Sample

    191030-74m7ldmwsn

  • MD5

    8b6bc16fd137c09a08b02bbe1bb7d670

  • SHA1

    c69a0f6c6f809c01db92ca658fcf1b643391a2b7

  • SHA256

    e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678

  • SHA512

    b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24

Malware Config

Extracted

Path

\??\c:\users\admin\documents\_R_E_A_D___T_H_I_S___FLDL9_.txt

Family

cerber

Ransom Note
CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/A630-0910-E3A4-0446-9808 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/A630-0910-E3A4-0446-9808 2. http://p27dokhpz2n7nvgr.14ewqv.top/A630-0910-E3A4-0446-9808 3. http://p27dokhpz2n7nvgr.14vvrc.top/A630-0910-E3A4-0446-9808 4. http://p27dokhpz2n7nvgr.129p1t.top/A630-0910-E3A4-0446-9808 5. http://p27dokhpz2n7nvgr.1apgrn.top/A630-0910-E3A4-0446-9808 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/A630-0910-E3A4-0446-9808

http://p27dokhpz2n7nvgr.12hygy.top/A630-0910-E3A4-0446-9808

http://p27dokhpz2n7nvgr.14ewqv.top/A630-0910-E3A4-0446-9808

http://p27dokhpz2n7nvgr.14vvrc.top/A630-0910-E3A4-0446-9808

http://p27dokhpz2n7nvgr.129p1t.top/A630-0910-E3A4-0446-9808

http://p27dokhpz2n7nvgr.1apgrn.top/A630-0910-E3A4-0446-9808

Extracted

Path

\??\c:\users\admin\appdata\local\microsoft\office\16.0\_R_E_A_D___T_H_I_S___G7H1IS_.txt

Family

cerber

Ransom Note
CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/3C50-CE8C-AA7E-0446-992E Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/3C50-CE8C-AA7E-0446-992E 2. http://p27dokhpz2n7nvgr.14ewqv.top/3C50-CE8C-AA7E-0446-992E 3. http://p27dokhpz2n7nvgr.14vvrc.top/3C50-CE8C-AA7E-0446-992E 4. http://p27dokhpz2n7nvgr.129p1t.top/3C50-CE8C-AA7E-0446-992E 5. http://p27dokhpz2n7nvgr.1apgrn.top/3C50-CE8C-AA7E-0446-992E ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/3C50-CE8C-AA7E-0446-992E

http://p27dokhpz2n7nvgr.12hygy.top/3C50-CE8C-AA7E-0446-992E

http://p27dokhpz2n7nvgr.14ewqv.top/3C50-CE8C-AA7E-0446-992E

http://p27dokhpz2n7nvgr.14vvrc.top/3C50-CE8C-AA7E-0446-992E

http://p27dokhpz2n7nvgr.129p1t.top/3C50-CE8C-AA7E-0446-992E

http://p27dokhpz2n7nvgr.1apgrn.top/3C50-CE8C-AA7E-0446-992E

Targets

    • Target

      e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678.exe

    • Size

      604KB

    • MD5

      8b6bc16fd137c09a08b02bbe1bb7d670

    • SHA1

      c69a0f6c6f809c01db92ca658fcf1b643391a2b7

    • SHA256

      e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678

    • SHA512

      b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Disabling Security Tools

1
T1089

Discovery

Remote System Discovery

1
T1018

Query Registry

1
T1012

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks