berbew | f93be4cb6093221e107b571f8d92bb251ebc2e1fd92a880e8903b2a818276c58 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

506d315652...cs.exe

windows7-x64

506d315652...cs.exe

windows10-2004-x64

Sharing

General

Target

506d3156525f240158e81d83f274ceb0_NeikiAnalytics
Size

226KB
Sample

240511-b672vsed71
MD5

506d3156525f240158e81d83f274ceb0
SHA1

5ea6d0ec251cf87d1e29c1e27250dde280518ddb
SHA256

f93be4cb6093221e107b571f8d92bb251ebc2e1fd92a880e8903b2a818276c58
SHA512

d83c6c983f05c82b78a03abcebff4ed6312afd2c8b68b26ab6c6e90d02ad80498362811833b8a39d9db282800f5b4d56288a98a84907ab3f5be3acd9302e18e6
SSDEEP

6144:KUSiZTK40lUHTisQt9Nd1Kid908edttRURLwO:KUvRK4ZusQHNd1KidKjttRYLwO

Score

10^/10

berbew backdoor dropper trojan upx

Static task

static1

upx backdoor trojan dropper berbew

4 signatures

Behavioral task

behavioral1

Sample

506d3156525f240158e81d83f274ceb0_NeikiAnalytics.exe

Resource

win7-20240508-en

backdoor dropper trojan upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

506d3156525f240158e81d83f274ceb0_NeikiAnalytics.exe

Resource

win10v2004-20240226-en

backdoor dropper trojan upx

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  506d3156525f240158e81d83f274ceb0_NeikiAnalytics
- Size
  
  226KB
- MD5
  
  506d3156525f240158e81d83f274ceb0
- SHA1
  
  5ea6d0ec251cf87d1e29c1e27250dde280518ddb
- SHA256
  
  f93be4cb6093221e107b571f8d92bb251ebc2e1fd92a880e8903b2a818276c58
- SHA512
  
  d83c6c983f05c82b78a03abcebff4ed6312afd2c8b68b26ab6c6e90d02ad80498362811833b8a39d9db282800f5b4d56288a98a84907ab3f5be3acd9302e18e6
- SSDEEP
  
  6144:KUSiZTK40lUHTisQt9Nd1Kid908edttRURLwO:KUvRK4ZusQHNd1KidKjttRYLwO
Score

10^/10

backdoor dropper trojan upx
- Malware Dropper & Backdoor - Berbew
  Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
  backdoor trojan dropper
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upxbackdoortrojandropperberbew

behavioral1

backdoordroppertrojanupx

behavioral2

backdoordroppertrojanupx

© 2018-2025

Terms | Privacy