Overview

overview

10

Static

static

10

3f0775da66...cs.exe

windows7-x64

10

3f0775da66...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f0775da6659ebe61abefbc2e68517c0_NeikiAnalytics.exe

  • Size

    664KB

  • Sample

    240526-artegsgf89

  • MD5

    3f0775da6659ebe61abefbc2e68517c0

  • SHA1

    f0907a7bf0511d0d0ef5a18d2942fda150817c43

  • SHA256

    c0c0c35d790714e9ea63963de012a6595e7a83985c6c7cc89ed797b1fea98028

  • SHA512

    89405cf74c8edd4e1c57c4b114df98fc4a4e6ae1828c784b6bb9905c02496078be06e3745b234d66687d304a982ff714f0999a6096fd0cb1da62a97c17d153dc

  • SSDEEP

    12288:JC5AZppV6yYPv058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54F:4A7WceKWNUir2MhNl6zX3w9As/xO23Wn

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      3f0775da6659ebe61abefbc2e68517c0_NeikiAnalytics.exe

    • Size

      664KB

    • MD5

      3f0775da6659ebe61abefbc2e68517c0

    • SHA1

      f0907a7bf0511d0d0ef5a18d2942fda150817c43

    • SHA256

      c0c0c35d790714e9ea63963de012a6595e7a83985c6c7cc89ed797b1fea98028

    • SHA512

      89405cf74c8edd4e1c57c4b114df98fc4a4e6ae1828c784b6bb9905c02496078be06e3745b234d66687d304a982ff714f0999a6096fd0cb1da62a97c17d153dc

    • SSDEEP

      12288:JC5AZppV6yYPv058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjmR54F:4A7WceKWNUir2MhNl6zX3w9As/xO23Wn

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks