Static and dynamic analysis of a Cerber ransomware sample, carried out in an isolated virtual machine. The goal was to identify the sample, understand what it does to a host, and extract indicators that would let a SOC detect it.
Academic malware-analysis project, TEK-UP University. The sample was handled only inside an isolated analysis VM; no sample is included in this repository.
| Step | Tool | What it showed |
|---|---|---|
| File identification | file |
Confirmed the executable type |
| Metadata | exiftool |
Headers and compile metadata of the binary |
| Strings | strings |
Readable strings, hinting at the sample's behaviour |
| Local AV scan | ClamAV | Flagged the sample as malicious |
| Reputation | VirusTotal | Detection across many engines; identified as Cerber |
| Sandbox report | Hybrid Analysis | Behavioural report pulled before detonation |
| Step | Tool | What it showed |
|---|---|---|
| Detonation | isolated Windows VM | The ransomware's behaviour on a live host |
| Filesystem changes | Regshot | Files added by the sample |
| Registry changes | Regshot | Registry keys created and modified for persistence |
The before/after registry and filesystem comparison is how the sample's persistence and its host footprint become indicators a detection rule can key on.
 |
 |
| VirusTotal: the sample identified as Cerber | Readable strings extracted from the binary |
 |
 |
| Regshot: files added during detonation | Regshot: registry keys modified for persistence |
More screenshots are in docs/img/.
- A complete static-then-dynamic workflow on a real ransomware family, inside a safe lab.
- Comfort with the standard analyst toolbox:
file,exiftool,strings, ClamAV, VirusTotal, Hybrid Analysis and Regshot. - The analyst mindset that matters for a SOC: turning what a sample does into indicators and detection opportunities, not just a verdict.
Rayen Gader - Cyber Security Engineer, L2 SOC analyst · Portfolio · LinkedIn · rayengader9@gmail.com