Overview

overview

10

Static

static

10

2108434f5d...cs.exe

windows7-x64

10

2108434f5d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2108434f5df6eb312dee968c9b9ef7b0_NeikiAnalytics.exe

  • Size

    128KB

  • Sample

    240527-gezt3aah66

  • MD5

    2108434f5df6eb312dee968c9b9ef7b0

  • SHA1

    372397a751f3edfefd979849ad38c80b0254624a

  • SHA256

    b25a88154199b6b01610208c6e73430a484fdb47303b859dd4dd5d9cba5c39a3

  • SHA512

    e1e00d61f7b09d02b1d20bc562af1511fe33137e9e8ea45a878367c371531c24f92dbebe53d962701a3a0843a7b56d3821efc840eb6174d29191c20ecf869029

  • SSDEEP

    1536:P4uGyMEo6pn93zcoOTYRZ5o1h902ekmx8kDAMRQD3DRfRa9HprmRfRJCLIXG:P6Ipp93VFvEQx8kcMeDz5wkpHxG

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      2108434f5df6eb312dee968c9b9ef7b0_NeikiAnalytics.exe

    • Size

      128KB

    • MD5

      2108434f5df6eb312dee968c9b9ef7b0

    • SHA1

      372397a751f3edfefd979849ad38c80b0254624a

    • SHA256

      b25a88154199b6b01610208c6e73430a484fdb47303b859dd4dd5d9cba5c39a3

    • SHA512

      e1e00d61f7b09d02b1d20bc562af1511fe33137e9e8ea45a878367c371531c24f92dbebe53d962701a3a0843a7b56d3821efc840eb6174d29191c20ecf869029

    • SSDEEP

      1536:P4uGyMEo6pn93zcoOTYRZ5o1h902ekmx8kDAMRQD3DRfRa9HprmRfRJCLIXG:P6Ipp93VFvEQx8kcMeDz5wkpHxG

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks