This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Community Blog
Subscribe to the official NetWitness Community blog for information about new product features, industry insights, best practices, and more.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • NetWitness Community
  • Blog
  • The Evolution of Cerber… v4.1.x

The Evolution of Cerber… v4.1.x

KevinStear1
Employee KevinStear1
Employee
Options
  • Subscribe to RSS Feed
  • Mark as New
  • Mark as Read
  • Bookmark
  • Subscribe
  • Email to a Friend
  • Printer Friendly Page
  • Report Inappropriate Content
‎2016-11-04 04:59 PM

During the end of October 2016, we have had the pleasure of witnessing yet another step in the evolution of Cerber as version 4.1.0 appeared in the wild. And while the ‘soupe de jour’ shares many similarities with past versions (much of which we detailed in our initial Cerber post[1]), there are enough differences here to warrant a brief breakdown of Cerber4. To conduct this analysis and consequently this discussion, we began with the reverse engineering and detonation of 68 Cerber4 hashes, each submitted to VirusTotal on October 30th and 31st.

In the Cerber 4.1.0 samples examined, the main payload is a typical installer that deletes itself after setting up the ransomware. Upon execution, the ransomware encrypts target files and tags them with a new 4-char extension (e.g., ‘.a8dd’, ‘.9ca1’, etc.). This is definitely a departure from the namesake ‘.cerber’ encrypted file extensions and sadly thwarts many basic detection capabilities.   Post encryption the executable also places a single README.HTA file in each affected folder; this is another change from past flavors of Cerber that have historically dropped three files to “help the user”. In any case, this HTML application displays instructions (accompanied by SpVoice Speak) for how to unlock encrypted files by paying a ransom.

 

cerber4.png

On the network side of things, we observed DNS and then callouts to ‘btc[.]blockr[.]io’ as well as a slew of payment sites, which all appear to match patterns of key[.]6-char DGA[.]TLD, which remains consistent with the findings of our September Cerber post. Each of these payment sites is registered to Eranet International Limited (naturally), and they all appear to backend into cerberhhyed5frqa[.]6-char DGA[.]bid domains and dedicated malware servers. Like its predecessors v4.1.0 also lacks formal Command and Control (C2); instead we observed the expected UDP spray on port 6892 out to 194.165.16.0/24. This recognized netblock has been attributed to recent EITest RIG Exploit Kit (EK) banking[2] and now to Cerber campaigns. The Maltego graph below depicts an initial breakdown of Cerber4 infrastructure and related domains (as of Nov 1st, 2016).

 

Screen Shot 2016-11-01 at 2.35.56 PM.png

Upon closer evaluation of the Cerber infrastructure, our observations immediately correlated with the current pseudo-darkleech-RIGv-Cerber4.1.0-1 campaign. This probable attribution is based on continued infrastructure reuse (e.g., EITest gate), current open source intelligence[3][4], and overall cohesiveness with past tactics, techniques, and procedures (TTPs).

In addition to Cerber payload, we also noted some secondary activity with callbacks out to Akamai infrastructure (possibly leveraging Akamai GHost). We believe this is consistent with the growing trend for ransomware to be deployed along with more mainstream crimeware (adware, spyware, RATs, etc.), which aims to establish a secondary revenue stream (e.g., malvertising). A snapshot of our graphing for relevant IPv4 addresses and domains from these callbacks can be found below. (Note: FirstWatch is continuing its assessment of this and related trends from other campaigns as part of concurrent EK-specific effort).

 

Screen Shot 2016-11-01 at 2.22.48 PM.png

 

Current NetWitness and ESA detection rules still correctly identify Cerber and have been adjusted to include detection of v4.1.0 and v4.1.1. Specifically, new keys were added to the existing App Rule that detects Cerber pay-sites that correlate to embedded configuration files for the malware’s set up of bitcoin wallets for each victim.  This rule matches when the 'alias.host' (packet) or 'fqdn' (web logs) begins with one of the identified hostname patterns.  Additionally, we also added 'btc[.]blockr[.]io' to the first stage of the existing Cerber ESA rule that identifies outbound DNS (i.e., whitelisted) directly followed by a C2-ish UDP spray on port 6892.  

As with any of our efforts, all observed indicators of compromise (IOCs) have been disseminated via the FirstWatch Exploit Domains and FirstWatch Exploit IP feeds as of today, Nov 4th, 2016.  Hits on these feeds will tag corresponding meta data with threat.desc = "cerber4" (for cerber4 specific domains and IPs) or "EITest" for infrastructure leveraged during the corresponding Cerber4 campaign.   

 

Big thanks to Ray, Rotem, Christopher Elisan, and Angela Stranahan for their support on this effort.

 

Screen Shot 2016-10-12 at 3.42.51 PM.png

 

[1] https://community.rsa.com/community/products/netwitness/blog/2016/09/27/the-evolution-of-cerber

[2] https://otx.alienvault.com/browse/pulses/?q=194.165.16

[3] http://www.malware-traffic-analysis.net/2016/10/31/index3.html

[4] https://medium.com/@rivafy89/2016-10-02-ek-psuedo-darkleech-rig-ek-cerber-1534b6186aca#.ufolv9sbh

  • cerber
  • cerber4
  • firstwatch
  • NetWitness
  • NW
  • NWP
  • ransomware
  • RSA NetWitness
  • RSA NetWitness Platform
1 Like
Share

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

  • Comment
Latest Articles
  • Agent Tesla: The Information Stealer
  • Threat Analysis: Detecting “Follina” (CVE-2022-30190) RCE Vulnerability with Netwitness Endpoint
  • Introducing NetWitness Vision XDR
  • Introducing NetWitness Platform XDR v12.0
  • Atlassian Confluence Zero-day Vulnerability (0-Zero) CVE-2022-26134: What You Need To Know
  • ‘Follina’ CVE-2022-30190 0-Day: What You Need To Know
  • CVE-2022-1388: BIG-IP iControl REST RCE Vulnerability
  • Ragnar Locker Ransomware: The Rampage Continues…
  • Ransomware Email Attacks: Beware of BazarLoader
  • Detecting Impacket with Netwitness Endpoint
Labels
  • Announcements 54
  • Events 2
  • Features 9
  • Integrations 6
  • Resources 57
  • Tutorials 21
  • Use Cases 21
  • Videos 116
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.