c3rb3rMalware
Last reported 2 years ago, by Huntress1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1505.003Web Shell
“After gaining administrative access with the injected admin user, adversaries are free to install an Atlassian Web Shell plugin to execute code remotely, pilfer sensitive information from the Confluence spaces, or install ransomware.”
What the reports say
1 report, newest first · the exact sentence from each-
Confluence to Cerber: Exploitation of CVE-2023-22518“Based on analysis, the PE file is a ransomware variant in the Cerber (or C3RB3R) family, appending L0CK3D to encrypted files.”
Indicators in its reports
named in the reports above- 5a2c6938554f9e54…9245303bda39in 1 report
- hxxp://193.176.179[.]41/tmp.37in 1 report
- 193.176.179[.]41in 1 report
- hxxp://193.176.179[.]41/tmp.37.txtin 1 report
- f2e17ec85c3f8ee2…aa82a9d9707fin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.