Month: May 2017

05-30-2017 Kovter Malware Configuration


Source: http://www.malware-traffic-analysis.net/2017/05/30/index3.html


05-30-2017 – Kovter config (defanged):

  • cp1::115[.]141[.]144[.]155:80>196[.]18[.]220[.]197:80>111[.]181[.]22[.]130:80>241[.]191[.]106[.]196:80>101[.]232[.]174[.]116:80>27[.]165[.]58[.]104:80>115218[.]212[.]4:80>23[.]199[.]135[.]243:80>171[.]98[.]66[.]193:80>87[.]179[.]163[.]192:8080>246[.]38[.]96[.]164:80>188[.]191[.]63[.]246:80>134[.]105[.]3[.]91:80>120[.]114[.]52[.]254:80>192[.]170[.]199[.]3:80>171[.]89[.]31[.]78:80>150[.]68[.]63[.]246:80>178[.]168[.]24[.]168:53856>158[.]18[.]210[.]249:8080>74[.]107[.]177[.]73:80>114[.]242[.]151[.]116:8080>66[.]205[.]125[.]144:80>19[.]212[.]37[.]10:8080>253[.]187[.]101[.]22:443>53[.]180[.]117[.]7:80>243[.]81[.]24[.]164:443>231[.]23[.]140[.]126:80>234[.]192[.]88[.]104:80>62[.]123[.]36[.]99:80>224[.]97[.]64[.]69:80>163[.]121[.]42[.]25:80>214[.]12[.]208[.]238:80>106[.]213[.]198[.]246:443>81[.]225[.]20[.]169:80>100[.]230[.]196[.]136:80>72[.]105[.]170[.]136:80>32[.]43[.]40[.]74:443>167[.]32[.]78[.]120:80>253[.]226[.]227[.]196:80>55[.]22[.]186[.]75:8080>4[.]175[.]165[.]200:443>238[.]16[.]160[.]152:80>78[.]184[.]194[.]117:80>6[.]29[.]34[.]83:80>47[.]81[.]119[.]19:80>89[.]42[.]251[.]164:443>190[.]147[.]231[.]186:20631>190[.]14[.]254[.]34:80>59[.]180[.]151[.]107:443>191[.]242[.]204[.]19:80>78[.]135[.]99[.]179:8080>108[.]83[.]139[.]121:50409>96[.]86[.]187[.]121:8080>191[.]102[.]111[.]166:80>190[.]183[.]222[.]157:443>80[.]82[.]69[.]181:443>80[.]74[.]43[.]10:80>233[.]14[.]68[.]142:80>123[.]125[.]229[.]28:8080>125[.]106[.]204[.]63:80>206[.]68[.]251[.]239:8080>144[.]31[.]232[.]8:80>253[.]87[.]122[.]41:80>16[.]18[.]110[.]83:80>68[.]206[.]29[.]41:443>166[.]84[.]253[.]228:27645>203[.]41[.]47[.]186:80>190[.]216[.]168[.]197:443>166[.]29[.]132[.]206:80>147[.]223[.]235[.]230:80>47[.]181[.]156[.]88:80>204[.]53[.]242[.]202:443>38[.]149[.]12[.]84:8080>203[.]19[.]41[.]116:80>50[.]27[.]244[.]182:8080>73[.]200[.]93[.]47:37764>140[.]228[.]227[.]227:80>176[.]225[.]118[.]123:80>155[.]17[.]207[.]239:443>155[.]2[.]137[.]15:80>186[.]41[.]206[.]113:8080>65[.]185[.]217[.]157:80>42[.]204[.]6[.]14:25257>182[.]238[.]197[.]49:80>97[.]65[.]129[.]80:443>28[.]82[.]42[.]43:443>228[.]84[.]250[.]85:80>59[.]15[.]63[.]216:80>2[.]195[.]102[.]15:35099>28[.]253[.]215[.]77:80>56[.]141[.]49[.]136:443>77[.]217[.]88[.]119:80>61[.]202[.]1[.]145:80>60[.]159[.]111[.]21:80>207[.]23[.]89[.]54:80>107[.]82[.]35[.]66:80>210[.]122[.]43[.]3:443>89[.]79[.]219[.]177:80>225[.]237[.]145[.]225:443>193[.]30[.]31[.]48:80>180[.]255[.]73[.]13:80>111[.]119[.]134[.]146:80>36[.]100[.]51[.]79:443>52[.]168[.]182[.]15:80>125[.]240[.]72[.]14:80>198[.]206[.]239[.]228:8080>152[.]253[.]107[.]165:25334>218[.]28[.]185[.]108:80>221[.]208[.]7[.]44:8080>59[.]212[.]237[.]74:80>107[.]58[.]118[.]121:80>60[.]72[.]251[.]33:80>30[.]184[.]68[.]137:80>119[.]99[.]121[.]48:80>78[.]13[.]158[.]85:8080>213[.]143[.]14[.]195:80>60[.]46[.]19[.]177:8080>31[.]236[.]237[.]26:443>52[.]56[.]197119:80>35[.]238[.]35[.]156:443>240[.]233[.]42[.]143:80>99[.]101[.]205[.]112:80>167[.]171[.]86[.]185:80>251[.]216[.]73[.]233:80>29[.]42[.]27[.]148:33314>130[.]13[.]216[.]160:29549>202[.]140[.]1[.]45:50350>156[.]25[.]117[.]71:52187>47[.]163[.]106[.]7:80>248[.]65[.]112[.]35:32961>5[.]12[.]152[.]135:80>113[.]39[.]21[.]52:80>52[.]29[.]146[.]2:45167>170[.]118[.]255[.]24:443>163[.]129[.]171[.]142:443>164[.]206[.]68[.]198:8080>73[.]210[.]194[.]207:80>245[.]254[.]102[.]229:27968>154[.]2[.]50[.]155:443>219[.]18[.]186[.]243:443>93[.]116[.]98[.]235:443>7[.]186[.]140[.]204:80>212[.]158[.]166[.]163:8080
  • ::cp1cptm::30
  • ::cptmkey::a7887cc809cf0d4df17fc5dafd03e4e7
  • ::keypass::65537::14406956202432696895736687188870795120627810060521362506850484529030787594235120234766403835925237875846638182799042644968600828041687576473785309015583662674951850437472487005879034960457006816565767874695988027974576743932237265685020252660393389625334454679973629213573098262335995899485490056715516541958306441081242373821925283273321477043778370261979951264345823069930049370001653689660526979663070957005463434715672722806350258573076246621922111133674162280380209038690713958217862705956100034284655680232375254753873913420277723177446168453669813713305530603681181107716902002186628301583597468419118033906489
  • ::passdebug::0
  • ::debugelg::1
  • ::elgdl_sl::0
  • ::dl_slb_dll::0
  • ::b_dllnonul::hxxp://185[.]117[.]72[.]90/upload2[.]php
  • ::nonuldnet32::hxxp://download[.]microsoft[.]com/download/0/8/c/08c19fa4-4c4f-4ffb-9d6c-150906578c9e/NetFx20SP1_x86[.]exe
  • ::dnet32dnet64::hxxp://download.microsoft.com/download/9/8/6/98610406-c2b7-45a4-bdc3-9db1b1c5f7e2/NetFx20SP1_x64[.]exe
  • ::dnet64pshellxp::hxxp://download[.]microsoft[.]com/download/E/C/E/ECE99583-2003-455D-B681-68DB610B44A4/WindowsXP-KB968930-x86-ENG[.]exe
  • ::pshellxppshellvistax32::hxxp://download[.]microsoft[.]com/download/A/7/5/A75BC017-63CE-47D6-8FA4-AFB5C21BAC54/Windows6[.]0-KB968930x86[.]msu
  • ::pshellvistax32pshellvistax64::hxxp://download[.]microsoft[.]com/download/3/C/8/3C8CF51E-1D9D-4DAAAAEA-5C48D1CD055C/Windows6[.]0-KB968930-x64[.]msu
  • ::pshellvistax64pshell2k3x32::hxxp://download[.]microsoft[.]com/download/1/1/7/117FB25C-BB2D-41E1-B01E-0FEB0BC72C30/WindowsServer2003-KB968930-x86-ENG[.]exe
  • ::pshell2k3x32pshell2k3x64:hxxp://download[.]microsoft[.]com/download/B/D/9/BD9BB1FF-6609-4B10-9334-6D0C58066AA7/WindowsServer2003-KB968930-x64-ENG[.]exe
  • ::pshell2k3x64cl_fv::24
  • ::cl_fvfl_fu::hxxps://fpdownload[.]macromedia[.]com/get/flashplayer/current/licensing/win/install_flash_player_24_active_x[.]exe
  • ::fl_fumainanti::DD1D:1:DD1DDD2D:1:DD2DDD3D:1:DD3DDD4D:1:DD4DDD5D:0:DD5DDD6D:1:DD6DDD7D:1:DD7DDD8D:1:DD8DDD9D:1:DD9DDD10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:hxxp://185[.]117[.]72[.]90/upload[.]php:al::mainanti

Emotet Banking Trojan: Malware Analysis

Goal: Reverse the pervasive Trojan banking Trojan “Emotet.”

MD5: bccf2bba9cd34b2fffa13bfaa9dd73d0
SHA-1: 2bda61456d64a2c509b19d49516f5c942be90d44
SHA–256: 9bb033dc2815798cd2c8b1a496c319a190a29ca59ea1053ab0b6fcf809630036
Imphash: 4c523782bd5ed7ca8f9ac7efc2d8d75f
Other related samples based on the variant’s imphash:
  • 9bb033dc2815798cd2c8b1a496c319a190a29ca59ea1053ab0b6fcf809630036
  • 33441312c20fbeccffceb522e626aa47366a966c48be537d82d4ecc60858d14c
  • 3d41a652e368875bdf55653dc4c43237f4b0eb70c028fe43454be02309cfc11b
  • ff25f74c91530371232bb7f5350d14252499de9a748a5e76d4b40959e64cfd30
  • 8102bda902667eabb34ebaf84f6ff15fb01804811c4b5bc4d6ac1a3871ea985a
  • ae8ef4600413adc25b32d202a8e2a4042650c234cde969251861b9ea2b2391f9
  • f5b8507645d9a2b672515bc990d149566e6272802c339219c2bd9e0ee19a1b88
  • 38a7f6b64f72c9202489b7e028a65f19cf0ff7008de7330e9f6154223e7dda78
  • df277353e4ec5d69a24b570f31fbc2376f35e6e18457d1985f556efee633456c
Emotet queries HKCU and HKLM Shell Folder directories:
The malware copies itself into %APPDATA%\QuotaSms as “QuotaSms[.]exe”:
Emotet Trojan creates persistency as an lnk file in the Startup directory:
Emotet creates an identical process as “CREATE_SUSPENDED,” injects itself into it via WriteProcessMemory, launches the new ResumeThread and kills the main process.

Dynamic Analysis: Emotet Trojan
+ Utilizes dynamic API loading via GetProcAddress
+ Implements self-kill routine via CreateThread with WriteProcessMemory
+ Creates multiple suspended threads and writes malware into them using WriteProcessMemory
+ Creates persistency as a QuotaSms[.]exe lnk file in Startup directory
+ Copies itself into %APPDATA%
+ Queries SSL :443 server and get assigned a peer at :8080

0027s > AnalyzeProcess pid:5600 C:\Documents and Settings\Administrator\Desktop\emotet[.]exe
0059s >  WriteProcessMemory
File: emotet[.]exe
Size: 216576 Bytes
MD5: BCCF2BBA9CD34B2FFFA13BFAA9DD73D0

Corebot Modular Trojan: Malware Analysis

Goal: Dissect modular Corebot banking Trojan with its DGA, rootkit, Powershell, runas, screenshot, process injection into svchost in SUSPENDED_MODE, and other modules.



MD5: 854d7769ed01915df8374ff18ae6785e
SHA-1: f923923e7af017e77e80d57578cfd88b990ce1e5
SHA-256: 0ce3290ed92979a5f13fbb799d7128e9dbc579e3f1bea3b560551a73f482de8f
imphash: 63c53219cb193f80ff22f173a8ffef05
Size: 640.0 KB (655361 bytes)

Static Analysis: Corebot 
PDB: .rdata:00D14278 C:\\work\\itco\\core\\bin\\x86\\Release\\core[.]pdb\
Timestamp: Wed Oct 14 07:56:42 2015

Inject functions:


   
Powershell module (powershell[.]exe -NonInteractive -NoProfile -NoLogo -ExecutionPolicy Unrestricted -File “%s” via “cmd mode con cols=4000 line s=1000”):


Self-deletion batch script:

Runas as explorer[.]exe module:


User-mode rootkit module -> “\\\\.\\PhysicalDrive0”:



Xfer from the user-mode rootkit module routine:

DGA seed algorithm:

Create a process %WINDIR%\System32\svchost[.]exe with the CREATE_SUSPENDED flag. The primary thread of the new process is created in a suspended state, and does not run until the ResumeThread function is called.



Red Flags:
  • The file modifies the registry
  • The file references Alternate Data Stream (ADS)
  • The file is scored (40/54) by VirusTotal
  • The file references the Remote Desktop Session Host Server
  • The file references the Windows Native API
  • The file references the Security Descriptor Definition Language (SDDL)
  • The file references the Service Control Manager (SCM)
  • The file references the Desktop window
  • The file references the Windows Cryptographic interface
  • The file references the Windows Debug Helper interface
  • The file queries for files and streams
  • The file references the Event Log
  • The file references Inter-Process Communication (IPC)
  • The file references the Domain Name System (DNS) API 
  • The file references data on a Socket
  • The file references the RPC Network Data Representation (NDR) Engine
  • The file opts for Address Space Layout Randomization (ASLR)
  • The file opts for cookies on the stack (GS)
  • The file imports 2 decorated symbol(s)
  • The file has no Version
  • The file does not contain a digital certificate
  • The file checksum (0x00000000) is invalid
  • The debug file name (core[.]pdb) is different than the file name (corebot[.]exe)
Dynamic Analysis: Corebot

Mutexes: 
————————————————–

  • ::62DFDF4F-C9F7-4416-9688-41C7791D0C33  
  • {F4EE296B-9B08-4B04-8443-7E76A45FE740}


Process Analysis Log:
  • Process: svchost[.]exe
  • Size: 14336 Bytes
  • MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

—————————————————————————                         

Monitored RegKeys
Path -> Value *
————————————————–
Path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run –> Value: 1932a393-6ee2-a084-05de-868ddc92d287=C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\46604e10-2147-a135-0a93-c63f477cff8d\272f38ca-8023-4abc-a8f7-91009ce205a7[.]exe


Domain Generation Algorithm (DGA) resolution ending in *ddns[.]net:

Other bot information collector procedure forming request:
  • os_version
  • version
  • process_name
  • os_version_short
  • volume_sn
  • country_name
  • lang_name
  • default_browser
  • os_arch
  • is_admin
  • is_admin_group

p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 20.0px; font: 13.0px ‘Helvetica Neue’; color: #333333; -webkit-text-stroke: #333333} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 20.0px; font: 13.0px ‘Helvetica Neue’; color: #777777; -webkit-text-stroke: #777777} p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; line-height: 20.0px; font: 13.0px ‘Helvetica Neue’; color: #333333; -webkit-text-stroke: #333333; min-height: 15.0px} p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Helvetica; color: #000000; -webkit-text-stroke: #000000; min-height: 13.0px} p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Helvetica; color: #000000; -webkit-text-stroke: #000000} span.s1 {font-kerning: none} span.s2 {text-decoration: underline ; font-kerning: none} span.Apple-tab-span {white-space:pre}

05-22-2017 Reversing: Cerber Ransomware Configuration

Type: Ransomware
Variant: Cerber
Malware Source: 521089667da9de525381eb23c780ad8b3d6e64d9c95a71f10d8f6d4f2af1f561
Config Source: GitHub


Cerber Configuration:

I. [crbr]{“b“:”17gd1msp5FnMcEMF1MitTNSsYs7w7AQyCt”,”i“:”17513″,”o“:”p27dokhpz2n7nvgr”,”p“:[“129p1t[.]top”,”1apgrn[.]top”,”1p5fwl[.]top”,”1cknbd[.]top”,”1fu8p3[.]top”]}[crbr]

II. {“blacklist“:{“extensions“:[“.bat”,”.cmd”,”.com”,”.cpl”,”.dll”,”.exe”,”.hta”,”.msc”,”.msi”,”.msp”,”.pif”,”.scf”,”.scr”,”.sys”],”files“:[“bootsect.bak”,”iconcache.db”,”ntuser.dat”,”thumbs.db”],”folders”:[“:\\$getcurrent\\”,”:\\$recycle.bin\\”,”:\\$windows.~bt\\”,”:\\$windows.~ws\\”,”:\\boot\\”,”:\\documents and settings\\all users\\”,”:\\documents and settings\\defaultuser\\”,”:\\documents and settings\\localservice\\”,”:\\documents and settings\\networkservice\\”,”:\\intel\\”,”:\\msocache\\”,”:\\perflogs\\”,”:\\program files (x86)\\”,”:\\program files\\”,”:\\programdata\\”,”:\\recovery\\”,”:\\recycled\\”,”:\\recycler\\”,”:\\system volume information\\”,”:\\temp\\”,”:\\windows.old\\”,”:\\windows10upgrade\\”,”:\\windows\\”,”:\\winnt\\”,”\\appdata\\local\\”,”\\appdata\\locallow\\”,”\\appdata\\roaming\\”,”\\local settings\\”,”\\public\\music\\sample music\\”,”\\public\\pictures\\sample pictures\\”,”\\public\\videos\\sample videos\\”,”\\tor browser\\”],”languages“:[1049,1058,1059,1064,1067,1068,1079,1087,1088,1090,1091,1092,2072,2073,2092,2115]},”check“:{“language“:1},”debug”:0,”default”:{“bchn“:”17gd1msp5FnMcEMF1MitTNSsYs7w7AQyCt”,”site_1“:”tor2web[.]org”,”site_2“:”onion[.]link”,”site_3“:”onion.nu”,”site_4“:”onion[.]cab”,”site_5“:”onion.to”,”tor“:”p27dokhpz2n7nvgr”},”encrypt“:{“bytes_skip“:1792,”divider“:262144,”encrypt“:1,”files”:[[“.123″,”.1cd”,”.3dm”,”.3ds”,”.3fr”,”.3g2″,”.3gp”,”.3pr”,”.602″,”.7z”,”7zip”,”.aac”,”.ab4″,”.abd”,”.acc”,”.accdb”,”.accde”,”.accdr”,”.accdt”,”.ach”,”.acr”,”.act”,”.adb”,”.adp”,”.ads”,”.aes”,”.agdl”,”.ai”,”.aiff”,”.ait”,”.al”,”.aoi”,”.apj”,”.apk”,”.arc”,”.arw”,”.ascx”,”.asf”,”.asm”,”.asp”,”.aspx”,”.asset”,”.asx”,”.atb”,”.avi”,”.awg”,”.back”,”.backup”,”.backupdb”,”.bak”,”.bank”,”.bat”,”.bay”,”.bdb”,”.bgt”,”.bik”,”.bin”,”.bkp”,”.blend”,”.bmp”,”.bpw”,”.brd”,”.bsa”,”.bz2″,”.c”,”.cash”,”.cdb”,”.cdf”,”.cdr”,”.cdr3″,”.cdr4″,”.cdr5″,”.cdr6″,”.cdrw”,”.cdx”,”.ce1″,”.ce2″,”.cer”,”.cfg”,”.cfn”,”.cgm”,”.cib”,”.class”,”.cls”,”.cmd”,”.cmt”,”.config”,”.contact”,”.cpi”,”.cpp”,”.cr2″,”.craw”,”.crt”,”.crw”,”.cry”,”.cs”,”.csh”,”.csl”,”.csr”,”.css”,”.csv”,”.d3dbsp”,”.dac”,”.das”,”.dat”,”.db”,”.db3″,”.db_journal”,”.dbf”,”.dbx”,”.dc2″,”.dch”,”.dcr”,”.dcs”,”.ddd”,”.ddoc”,”.ddrw”,”.dds”,”.def”,”.der”,”.des”,”.design”,”.dc”,”.dgn”,”.dif”,”.dip”,”.dit”,”.djv”,”.djvu”,”.dng”,”.doc”,”.docb”,”.docm”,”.docx”,”.dot”,”.dotm”,”.dotx”,”.drf”,”.drw”,”.dtd”,”.dwg”,”.dxb”,”.dxf”,”.dxg”,”.edb”,”.eml”,”.eps”,”.erbsql”,”.erf”,”.exf”,”.fdb”,”.ffd”,”.fff”,”.fh”,”.fhd”,”.fla”,”.flac”,”.flb”,”.flf”,”.flv”,”.forge”,”.fpx”,”.frm”,”.fxg”,”.gbr”,”.gho”,”.gif”,”.gpg”,”.gray”,”.grey”,”.groups”,”.gry”,”.gz”,”.h”,”.hbk”,”.hdd”,”.hpp”,”.html”,”.hwp”,”.ibank”,”.ibd”,”.ibz”,”.idx”,”.iif”,”.iiq”,”.incps”,”.indd”,”.info”,”.info_”,”.iwi”,”.jar”,”.java”,”.jnt”,”.jpe”,”.jpeg”,”.jpg”,”.js”,”.json”,”.k2p”,”.kc2″,”.kdbx”,”.kdc”,”.key”,”.kpdx”,”.km”,”.laccdb”,”.lay”,”.lay6″,”.lbf”,”.lck”,”.ldf”,”.lit”,”.litemod”,”.litesql”,”.lock”,”.ltx”,”.lua”,”.m”,”.m2ts”,”.m3u”,”.m4a”,”.m4p”,”.m4u”,”.m4v”,”.ma”,”.mab”,”.mapimail”,”.max”,”.mbx”,”.md”,”.mdb”,”.mdc”,”.mdf”,”.mef”,”.mfw”,”.mid”,”.mkv”,”.mlb”,”.mml”,”.mmw”,”.mny”,”.money”,”.moneywell”,”.mos”,”.mov”,”.mp3″,”.mp4″,”.mpeg”,”.mpg”,”.mrw”,”.ms11″,”.msf”,”.msg”,”.mts”,”.myd”,”.myi”,”.nd”,”.ndd”,”.ndf”,”.nef”,”.nk2″,”.nop”,”.nrw”,”.ns2″,”.ns3″,”.ns4″,”.nsd”,”.nsf”,”.nsg”,”.nsh”,”.nvram”,”.nwb”,”.nx2″,”.nxl”,”.nyf”,”.oab”,”.obj”,”.odb”,”.odc”,”.odf”,”.odg”,”.odm”,”.odp”,”.ods”,”.odt”,”.ogg”,”.oil”,”.omg”,”.one”,”.onenotec2″,”.orf”,”.ost”,”.otg”,”.oth”,”.otp”,”.ots”,”.ott”,”.p12″,”.p7b”,”.p7c”,”.pab”,”.pages”,”.paq”,”.pas”,”.pat”,”.pbf”,”.pcd”,”.pct”,”.pdb”,”.pdd”,”.pdf”,”.pef”,”.pem”,”.pfx”,”.php”,”.pif”,”.pl”,”.plc”,”.plus_muhd”,”.pm”,”.pm!”,”.pmi”,”.pmj”,”.pml”,”.pmm”,”.pmo”,”.pmr”,”.pnc”,”.pnd”,”.png”,”.pnx”,”.pot”,”.potm”,”.potx”,”.ppam”,”.pps”,”.ppsm”,”.ppsx”,”.ppt”,”.pptm”,”.pptx”,”.prf”,”.private”,”.ps”,”.psafe3″,”.psd”,”.pspimage”,”.pst”,”.ptx”,”.pub”,”.pwm”,”.py”,”.qba”,”.qbb”,”.qbm”,”.qbr”,”.qbw”,”.qbx”,”.qby”,”.qcow”,”.qcow2″,”.qed”,”.qtb”,”.r3d”,”.raf”,”.rar”,”.rat”,”.raw”,”.rb”,”.rdb”,”.re4″,”.rm”,”.rtf”,”.rvt”,”.rw2″,”.rwl”,”.rwz”,”.s3db”,”.safe”,”.sas7bdat”,”.sav”,”.save”,”.say”,”.sch”,”.sd0″,”.sda”,”.sdb”,”.sdf”,”.secret”,”.sh”,”.sldm”,”.sldx”,”.slk”,”.slm”,”.sql”,”.sqlite”,”.sqlite-shm”,”.sqlite-wal”,”.sqlite3″,”.sqlitedb”,”.sr2″,”.srb”,”.srf”,”.srs”,”.srt”,”.srw”,”.st4″,”.st5″,”.st6″,”.st7″,”.st8″,”.stc”,”.std”,”.sti”,”.stl”,”.stm”,”.stw”,”.stx”,”.svg”,”.swf”,”.sxc”,”.sxd”,”.sxg”,”.sxi”,”.sxm”,”.sxw”,”.tar”,”.tax”,”.tbb”,”.tbk”,”.tbn”,”.tex”,”.tga”,”.tgz”,”.thm”,”.tif”,”.tiff”,”.tlg”,”.tlx”,”.txt”,”.uop”,”.uot”,”.upk”,”.usr”,”.vb”,”.vbox”,”.vbs”,”.vdi”,”.vhd”,”.vhdx”,”.vmdk”,”.vmsd”,”.vmx”,”.vmxf”,”.vob”,”.vpd”,”.vsd”,”.wab”,”.wad”,”.wallet”,”.war”,”.wav”,”.wb2″,”.wk1″,”.wks”,”.wma”,”.wmf”,”.wmv”,”.wpd”,”.wps”,”.x11″,”.x3f”,”.xis”,”.xla”,”.xlam”,”.xlc”,”.xlk”,”.xlm”,”.xlr”,”.xls”,”.xlsb”,”.xlsm”,”.xlsx”,”.xlt”,”.xltm”,”.xltx”,”.xlw”,”.xml”,”.xps”,”.xxx”,”.ycbcra”,”.yuv”,”.zip”]],”max_block_size“:128,”min_file_size“:2048,”multithread“:1,”network“:1,”rsa_key_size“:880,”threads_per_core“:1},”files_name“:”_R_E_A_D___T_H_I_S___{RAND}_”,”run_by_the_end”:1},”self_deleting“:1,”servers“:{“statistics”:{“data_finish“:”e01ENV9LRVl9″,”data_start“:”e01ENV9LRVl9e1BBUlRORVJfSUR9e09TfXtJU19YNjR9e0lTX0FETUlOfXtDT1VOVF9GSUxFU317U1RPUF9SRUFTT059e1NUQVRVU30=”,”ip“:[“178[.]33[.]158[.]0/27″,”178[.]33[.]159[.]0/27″,”178[.]33[.]160[.]0/22″],”port“:6893,”send_stat“:1,”timeout“:255}},”wallpaper“:{“change_wallpaper”:1,”background“:139,”color“:16777215,”size“:13,”text“:”                     \n  CERBER RANSOMWARE  \n                     \n\n  YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMPORTANT FILES  \n  HAVE BEEN ENCRYPTED!  \n\n  The only way to decrypt your files is to receive  \n  the private key and decryption program.  \n\n  To receive the private key and decryption program  \n  go to any decrypted folder – inside there is the special file (*_READ_THIS_FILE_*)  \n  with complete instructions how to decrypt your files.  \n\n  If you cannot find any (*_READ_THIS_FILE_*) file at your PC,  \n  follow theinstructions below:  \n\n  1. Download \”Tor Browser\” from https://www.torproject%5B.%5Dorg/ and install it.  \n  2. In the \”Tor Browser\” open your personal page here:  \n\n  http://{TOR}.onion/{PC_ID}  \n\n  Note! This page is available via \”Tor Browser\”only.  \n\n\n”},” p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica}

p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica} p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica}