CerberMalware

crbr encryptor

A prolific ransomware which originally added ".cerber" as a file extension to encrypted files. Has undergone multiple iterations in which the extension has changed. Uses a very readily identifiable set of of UDP activity to checkin and report infections. Primarily uses TOR for payment information.From MISP Galaxy

Last reported 2 years ago, by Huntress1 report

ATT&CK techniques

1 technique · each with the sentence it comes from

T1505.003Web Shell

“After gaining administrative access with the injected admin user, adversaries are free to install an Atlassian Web Shell plugin to execute code remotely, pilfer sensitive information from the Confluence spaces, or install ransomware.”

HuntressVendor7 Nov 2023

What the reports say

1 report, newest first · the exact sentence from each

“Confluence to Cerber: Exploitation of CVE-2023-22518”

HuntressVendor7 Nov 2023
Confluence to Cerber: Exploitation of CVE-2023-22518

Indicators in its reports

named in the reports above

5a2c6938554f9e54…9245303bda39in 1 report
hxxp://193.176.179[.]41/tmp.37in 1 report
193.176.179[.]41in 1 report
hxxp://193.176.179[.]41/tmp.37.txtin 1 report
f2e17ec85c3f8ee2…aa82a9d9707fin 1 report

Copy these 5 indicators · defanged

5 indicators, defanged, one per line

5a2c6938554f9e54d291f8fa0837d8d1e34b9b310bd02076affd9245303bda39
hxxp://193.176.179[.]41/tmp.37
193.176.179[.]41
hxxp://193.176.179[.]41/tmp.37.txt
f2e17ec85c3f8ee26a3be3ce52c6e140448941d705a9bdedb7c1aa82a9d9707f

Thanks — we review every report.

Report a wrong match