App Review JS/Cerber.S!Eldorado Ransomware

[Lucent Warrior]

This short video is a demonstration of a Ransomware attack for those unaware of what they are,
and or what they do, and why it is necessary to make regular backups of your personal files.

Note the detection of the sample VT 5/57.
Also Note it bypassed Smartscreen & UAC.



Sample courtesy of @_CyberGhosT_ , thank you for the great catch.

 

[yigido]

Nice video with a nice piece of "FUD" sample
Please do not wait us for your videos, thanks friend

 

[hjlbx]

From Malwarebytes Blog

CERBER UAC Bypass
Cerber uses tricks to bypass Windows User Account Controll (UAC) and deploy itself with elevated privileges. It is achieved by the following steps:

1. Search an executable in C:\Windows\system32, that can auto elevate it’s privileges.
2. Search in it’s import table a DLL that can be hijacked
3. Copy the DLL into %TEMP% folder and patch it – add a code in a new section and patch entry point in order to redirect execution there. It will be used in order to run the cerber sample with elevated privileges. It uses: WinExec(“[cerber_path] -eval 2524“, SW_SHOWNORMAL)
4. Inject the code into explorer.exe – it is responsible for executing the UAC bypass. Creates a new folder in C:\Windows\system32 and copy there both files – an EXE and the patched DLL – under original names, then it deploys the EXE causing DLL to load and execute the malicious code.
5. When the UAC bypass is executed successfully, it is signalized to the original cerber sample by setting a property cerber_uac_status – added to a Shell_TrayWnd. Then, the original sample deletes dropped files and exits. Otherwise, it tries the same trick with different pair of EXE + DLL.

NOTE (Mine): User Space processes should not be permitted to copy any files in System Space and paste them to User Space. This copying of System Space objects and pasting them to User Space is used by malware types other than Cerber.
* * * * *

If you want further details see here: Cerber Ransomware – New, But Mature

 

[_CyberGhosT_]

Awesome, Thank you L'dub, you and Jack, and Av Gurus were an integral part of the
successful upload of this to the Hub and for that I am grateful.
I received this in my inbox at ProtonMail from a spammer that has been sending me Emails 2 to 3 times a week
for the past 3 months.
I sent the security team at ProtonMail an email explaining the situation and I hope they can block this sender from their servers.
Thank you for your time & patience in assisting me L'dub it has left an impression of the most positive nature.
It's just more proof positive of the type of community we are blessed to have here at MT.
PeAcE brother.

 

[frogboy]

Nice video @Lucent Warrior and a nice pickup @_CyberGhosT_ thanks to both members.

 

[Balrog]

...and this is why the backup is so important

 

[LabZero]

Awesome video!

And it also seems fast to encrypt files!

PS: this is what happens when malc0ders send crap mail in the wrong place lol!
So thank you Lucent, and CyberGhosT!

 

[Der.Reisende]

From Malwarebytes Blog

CERBER UAC Bypass
Cerber uses tricks to bypass Windows User Account Controll (UAC) and deploy itself with elevated privileges. It is achieved by the following steps:

1. Search an executable in C:\Windows\system32, that can auto elevate it’s privileges.
2. Search in it’s import table a DLL that can be hijacked
3. Copy the DLL into %TEMP% folder and patch it – add a code in a new section and patch entry point in order to redirect execution there. It will be used in order to run the cerber sample with elevated privileges. It uses: WinExec(“[cerber_path] -eval 2524“, SW_SHOWNORMAL)
4. Inject the code into explorer.exe – it is responsible for executing the UAC bypass. Creates a new folder in C:\Windows\system32 and copy there both files – an EXE and the patched DLL – under original names, then it deploys the EXE causing DLL to load and execute the malicious code.
5. When the UAC bypass is executed successfully, it is signalized to the original cerber sample by setting a property cerber_uac_status – added to a Shell_TrayWnd. Then, the original sample deletes dropped files and exits. Otherwise, it tries the same trick with different pair of EXE + DLL.

NOTE (Mine): User Space processes should not be permitted to copy any files in System Space and paste them to User Space. This copying of System Space objects and pasting them to User Space is used by malware types other than Cerber.
* * * * *

If you want further details see here: Cerber Ransomware – New, But Mature

Awesome addition, thank you for sharing!
@_CyberGhosT_ thank you for sharing the sample, keep it up

@Lucent Warrior Nice piece of breakfast TV, thank you for the work and the share
Like the idea of you and others grabbing emerging threats and packing them into educational moving pictures
Keep it up also please!

 

[Lucent Warrior]

...and this is why the backup is so important

So tell me, this sample just bypassed your security "including the OS built in" and encrypted all your files, there is no decryptor yet for this variety, or your just novice enough to not know that some of them exist, what do you do?

If you regularly back up your personal files, you would not have to sweat this, you have lost nothing but time fixing your system. So yes, backups are very important. That is unless you don't mind paying to get access back to your files.

 

[Viking]

 

[frogboy]

Now that would be an awesome addition to any keyboard.

 

[LabZero]

Totally agree with you guys!
Unfortunately, people understand the importance of the backup just when they realize that they don't have it.
Ransomware infects everyone but it seems just a few people know how to defend from it.

 

[askmark]

Thanks @Lucent Warrior for another great video.
I would be interested to know how this malware would fare against Voodooshield and it's VoodooAi engine.

 

[Lucent Warrior]

Thanks @Lucent Warrior for another great video.
I would be interested to know how this malware would fare against Voodooshield and it's VoodooAi engine.

AI is not available for this type of file yet, but none the less...

Spoiler: Cerber vs Voodooshield

 

[askmark]

AI is not available for this type of file yet, but none the less...

Spoiler: Cerber vs Voodooshield

View attachment 115908

Wow thanks @Lucent Warrior for the lightening response.

I must say I'm well pleased with that result