Overview

overview

10

Static

static

3

070c9b58be...4N.exe

windows7-x64

10

070c9b58be...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    070c9b58beb9b426124b7a51b7d31c69b06ce5b5daeef21b0a309ba45c0fbd84N

  • Size

    1.7MB

  • Sample

    240918-259r6sxhqc

  • MD5

    f9c9a052a87a47758715fdd5858f38d0

  • SHA1

    219e623a5ba5ed43f5fc9432ad9a2264204e7b00

  • SHA256

    070c9b58beb9b426124b7a51b7d31c69b06ce5b5daeef21b0a309ba45c0fbd84

  • SHA512

    4c12c3e7c298934ae6972d9a7b3b0d16a57f6c09d3f95bd12881239bc1ed28b44d908c074374042d8a20df44fcb9e3e7defd376697f61d37d674bd332d0005ce

  • SSDEEP

    49152:dix7/ix7yix7/ix7Xcix7/ix7yix7/ix7:dU/UyU/UXcU/UyU/U

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      070c9b58beb9b426124b7a51b7d31c69b06ce5b5daeef21b0a309ba45c0fbd84N

    • Size

      1.7MB

    • MD5

      f9c9a052a87a47758715fdd5858f38d0

    • SHA1

      219e623a5ba5ed43f5fc9432ad9a2264204e7b00

    • SHA256

      070c9b58beb9b426124b7a51b7d31c69b06ce5b5daeef21b0a309ba45c0fbd84

    • SHA512

      4c12c3e7c298934ae6972d9a7b3b0d16a57f6c09d3f95bd12881239bc1ed28b44d908c074374042d8a20df44fcb9e3e7defd376697f61d37d674bd332d0005ce

    • SSDEEP

      49152:dix7/ix7yix7/ix7Xcix7/ix7yix7/ix7:dU/UyU/UXcU/UyU/U

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.