berbew | a1a7535eda9c517751d8d1195d74160f6c85eb48069c13a783b708846197120a | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5b1ec19280...cs.exe

windows7-x64

5b1ec19280...cs.exe

windows10-2004-x64

Sharing

General

Target

5b1ec19280c49b98ecab126e710c9020_NeikiAnalytics
Size

239KB
Sample

240515-3z5fyabb29
MD5

5b1ec19280c49b98ecab126e710c9020
SHA1

b6d94c39ce6d90c68c9c07bb75304ef4743efad9
SHA256

a1a7535eda9c517751d8d1195d74160f6c85eb48069c13a783b708846197120a
SHA512

c42d02ea865286698fc82a3b41716336bc691d2caeba8f0ca4948b6720937296469f32240bbd43cae47c8a721a3ae11bd47b275ae8314f2df493ae8a8c4ebb0b
SSDEEP

3072:ydEUfKj8BYbDiC1ZTK7sxtLUIGT9kXH0hga4PjBy2XiXV/mwTwyg4K+mpPNHdUpj:yUSiZTK40V2a4PdyoeV/Hwz4zmpPNipj

Score

10^/10

berbew backdoor dropper trojan upx

Static task

static1

upx backdoor trojan dropper berbew

4 signatures

Behavioral task

behavioral1

Sample

5b1ec19280c49b98ecab126e710c9020_NeikiAnalytics.exe

Resource

win7-20240220-en

backdoor dropper trojan upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

5b1ec19280c49b98ecab126e710c9020_NeikiAnalytics.exe

Resource

win10v2004-20240508-en

backdoor dropper trojan upx

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  5b1ec19280c49b98ecab126e710c9020_NeikiAnalytics
- Size
  
  239KB
- MD5
  
  5b1ec19280c49b98ecab126e710c9020
- SHA1
  
  b6d94c39ce6d90c68c9c07bb75304ef4743efad9
- SHA256
  
  a1a7535eda9c517751d8d1195d74160f6c85eb48069c13a783b708846197120a
- SHA512
  
  c42d02ea865286698fc82a3b41716336bc691d2caeba8f0ca4948b6720937296469f32240bbd43cae47c8a721a3ae11bd47b275ae8314f2df493ae8a8c4ebb0b
- SSDEEP
  
  3072:ydEUfKj8BYbDiC1ZTK7sxtLUIGT9kXH0hga4PjBy2XiXV/mwTwyg4K+mpPNHdUpj:yUSiZTK40V2a4PdyoeV/Hwz4zmpPNipj
Score

10^/10

backdoor dropper trojan upx
- Malware Dropper & Backdoor - Berbew
  Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
  backdoor trojan dropper
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upxbackdoortrojandropperberbew

behavioral1

backdoordroppertrojanupx

behavioral2

backdoordroppertrojanupx

© 2018-2025

Terms | Privacy