MALICIOUS — cerber.exe

MALICIOUS — cerber.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cerber family. 7 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678
• SHA-1: c69a0f6c6f809c01db92ca658fcf1b643391a2b7
• MD5: 8b6bc16fd137c09a08b02bbe1bb7d670
• imphash: 9d6ed8d049bc10bc45b1995cb6f7f4b6
• ssdeep: 6144:yYghlI5/u8f1mr+4RJ99MpDa52RX5wRDhOOU0qsR:yYKlYmDXEpDHRXP01
• TLSH: T1CE4D8D5D06C41924E098F6119B1C9F0D6A6EC8EA2FBFA731C374713059A1393899F3B9
• Submitted as: cerber.exe
• File type: pe · Size: 619008 bytes
• Verdict: malicious (100/100) · Family: Cerber

Detections (7 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): {MD5}bin.ransomware.cerber.7439.UNOFFICIAL
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Cyble Vision: Cyble Vision: Cerber
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Ransom:Win32/Cerber
• Emsisoft (Emergency Kit): Trojan.Ransom.Kryptik.A

MITRE ATT&CK

• T1543.003
• T1112
• T1218.005

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged {MD5}bin.ransomware.cerber.7439.UNOFFICIAL (rule {MD5}bin.ransomware.cerber.7439.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Cyble Vision flagged Cyble Vision: Cerber (rule Cyble Vision: Cerber) - engine signal, weight 0.90, confidence 0.95
• 2 behavioral detection(s): LOLBin: mshta executing remote/scripted payload [high] (rule tl-lolbin-mshta) - dynamic signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Ransom:Win32/Cerber (rule Ransom:Win32/Cerber) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Ransom.Kryptik.A (rule Trojan.Ransom.Kryptik.A) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Extracted Cerber config (0 C2) - engine signal, weight 0.45, confidence 0.60
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22975 behavior events · 2 ATT&CK techniques · 14 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• staging.to-do.officeppe.com
• api.blockcypher.com
• teams.cloud.microsoft
• btc.blockr.io
• bitaps.com
• chain.so
• outlook.office.com
• outlook.office365.com
• www.bing.com
• desktop-hsgcbep
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• to-do.microsoft.com
• dns.msftncsi.com
• settings-win.data.microsoft.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• edge.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/4836/files/0c2fe9b516a37f78879c4b001cb925168af252b5f0a35da6997cd864a37c20b4 - 0c2fe9b516a37f78879c4b001cb925168af252b5f0a35da6997cd864a37c20b4
• /opt/CAPEv2/storage/analyses/4836/files/e44d6e4336ed7f39bd4053ac046a00cf39991ee6581344ae5121767c9971c01c - e44d6e4336ed7f39bd4053ac046a00cf39991ee6581344ae5121767c9971c01c
• /opt/CAPEv2/storage/analyses/4836/files/310ea93420e8f3f0f4119646fb5eba61ca225650b098a64775053d3dc8fc8ad1 - 310ea93420e8f3f0f4119646fb5eba61ca225650b098a64775053d3dc8fc8ad1
• /opt/CAPEv2/storage/analyses/4836/files/4f734ff5d1d19212230099ef7f0f48831b0fb4252a3c3116e796879380faecf5 - 4f734ff5d1d19212230099ef7f0f48831b0fb4252a3c3116e796879380faecf5
• /opt/CAPEv2/storage/analyses/4836/files/ef1100a8b574f190b3629d56641829f22357885f3761af7fa54b87971bf8c752 - ef1100a8b574f190b3629d56641829f22357885f3761af7fa54b87971bf8c752
• /opt/CAPEv2/storage/analyses/4836/files/b1313dd95eaf63f33f86f72f09e2ecd700d11159a8693210c37470fcb84038f7 - b1313dd95eaf63f33f86f72f09e2ecd700d11159a8693210c37470fcb84038f7
• /opt/CAPEv2/storage/analyses/4836/files/e834f7a97eeff3fe1f68b134421b9756b63342a17278763bc7b65d2ccb87a8a9 - e834f7a97eeff3fe1f68b134421b9756b63342a17278763bc7b65d2ccb87a8a9
• ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
• 3b98b5f1815c07510ba5bb2082032d8a442370a7f990ac926eb254479e495618 - 3b98b5f1815c07510ba5bb2082032d8a442370a7f990ac926eb254479e495618
• f60055f65891e6a0abc2d26f99f2a39eeb9b4d118e802669c77967ee9b83aa88 - f60055f65891e6a0abc2d26f99f2a39eeb9b4d118e802669c77967ee9b83aa88
• 53779238d1cc9ceddc3cf8a0debbfc2f3888a9c3cbfb0cbae4b1ae40b4aa5924 - 53779238d1cc9ceddc3cf8a0debbfc2f3888a9c3cbfb0cbae4b1ae40b4aa5924
• f54756e960b7153e24a3b551e7a0b7b1da0765a70d9e60c5f8ebb068df626323 - f54756e960b7153e24a3b551e7a0b7b1da0765a70d9e60c5f8ebb068df626323
• 6d6a74ae6c240e01e1f6123c7745701f27eb77b30078a27ab59e79b1f9f9b5bb - 6d6a74ae6c240e01e1f6123c7745701f27eb77b30078a27ab59e79b1f9f9b5bb
• 15fa1d7171c73ba6b0db694e1722624ae061d73c5d7405235f838840beddeb90 - 15fa1d7171c73ba6b0db694e1722624ae061d73c5d7405235f838840beddeb90

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

• schemas.microsoft.com
• staging.to-do.officeppe.com
• api.blockcypher.com
• btc.blockr.io
• bitaps.com
• chain.so

File paths

• K:\A9#[

More Cerber samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report