berbew | b309a78397703590a11e275f3a1c8575eb254b68639389b67993a9549bf8ac03 | Triage

Submit
Reports

Overview

overview

Static

static

406fd4de02...AS.exe

windows7-x64

406fd4de02...AS.exe

windows10-2004-x64

Sharing

General

Target

406fd4de02eadbcfddaea9a6d51f1f90_NEAS
Size

749KB
Sample

240507-a8869sba8x
MD5

406fd4de02eadbcfddaea9a6d51f1f90
SHA1

2ab8ecbfe3819a9de425d51f5a876f6a0dc8edfb
SHA256

b309a78397703590a11e275f3a1c8575eb254b68639389b67993a9549bf8ac03
SHA512

5b74d04f37ce9a7d1dc6baf5309a33654c9b96b09ec4e11085f1c53a2ca7078e13801e67e1632e1e51f22aafef22e455678aa2b215e2c2ec6bcad6b31426e165
SSDEEP

12288:pYIW0p98Oh8P7h8d2qWVTC0MwsHkNQ7NLlgjOETn4/5BWpUohOqnDMsMbol/XPRT:dW298E8uN0CHk+7NLlgjOETn4/5BWpUm

Score

10^/10

berbew backdoor dropper trojan

Static task

static1

backdoor trojan dropper berbew

3 signatures

Behavioral task

behavioral1

Sample

406fd4de02eadbcfddaea9a6d51f1f90_NEAS.exe

Resource

win7-20240215-en

backdoor dropper trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

406fd4de02eadbcfddaea9a6d51f1f90_NEAS.exe

Resource

win10v2004-20240419-en

backdoor dropper trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  406fd4de02eadbcfddaea9a6d51f1f90_NEAS
- Size
  
  749KB
- MD5
  
  406fd4de02eadbcfddaea9a6d51f1f90
- SHA1
  
  2ab8ecbfe3819a9de425d51f5a876f6a0dc8edfb
- SHA256
  
  b309a78397703590a11e275f3a1c8575eb254b68639389b67993a9549bf8ac03
- SHA512
  
  5b74d04f37ce9a7d1dc6baf5309a33654c9b96b09ec4e11085f1c53a2ca7078e13801e67e1632e1e51f22aafef22e455678aa2b215e2c2ec6bcad6b31426e165
- SSDEEP
  
  12288:pYIW0p98Oh8P7h8d2qWVTC0MwsHkNQ7NLlgjOETn4/5BWpUohOqnDMsMbol/XPRT:dW298E8uN0CHk+7NLlgjOETn4/5BWpUm
Score

10^/10

backdoor dropper trojan
- Malware Dropper & Backdoor - Berbew
  Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
  backdoor trojan dropper
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdoortrojandropperberbew

behavioral1

backdoordroppertrojan

behavioral2

backdoordroppertrojan

© 2018-2025

Terms | Privacy