berbew

General

Target

magic.exe
Size

11.2MB
Sample

240919-psqsbayhkm
MD5

2b6fa0f9cbe3f952fdb8177496461b53
SHA1

64e03359c3dc40288fb3755dc3eb28f6c4e5090e
SHA256

0e4c7ea1381577829677372822f13f5332f04047156d2e719e499c1546d0781e
SHA512

e235cbab4dca4b9b11c6596670c8972c562129dfe44c4000cf3a3707d2f1dd7af6cccfe04527249de74cadb7483cc6d464d5b812fab9924dd4f0d59dcf1a52a8
SSDEEP

196608:Vf3v86gVYibQQOOl2szsHFUK2r7UyTAdQmR8dA6lS8Qnf2ODjMnGydS8M9UprBOb:pWVHhZ2YsHFUK2JAdQJlaF3MnG38M9E

Score

10^/10

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  magic.exe
- Size
  
  11.2MB
- MD5
  
  2b6fa0f9cbe3f952fdb8177496461b53
- SHA1
  
  64e03359c3dc40288fb3755dc3eb28f6c4e5090e
- SHA256
  
  0e4c7ea1381577829677372822f13f5332f04047156d2e719e499c1546d0781e
- SHA512
  
  e235cbab4dca4b9b11c6596670c8972c562129dfe44c4000cf3a3707d2f1dd7af6cccfe04527249de74cadb7483cc6d464d5b812fab9924dd4f0d59dcf1a52a8
- SSDEEP
  
  196608:Vf3v86gVYibQQOOl2szsHFUK2r7UyTAdQmR8dA6lS8Qnf2ODjMnGydS8M9UprBOb:pWVHhZ2YsHFUK2JAdQJlaF3MnG38M9E
Score

10^/10

berbew blackmoon gandcrab modiloader sality backdoor banker discovery ransomware trojan upx
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- GandCrab payload
- Gandcrab
  Gandcrab is a Trojan horse that encrypts files on a computer.
  ransomware backdoor gandcrab
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1
- Target
  
  magic.pyc
- Size
  
  5KB
- MD5
  
  49bb6bfa71df81a89e3973098289fa6d
- SHA1
  
  b73842171f6dcdb4b04646b50da4ca5830237f1a
- SHA256
  
  127d4768fd4e43feb2c7b1663a5374858bc59db45f2e1f086144c5471e5a5584
- SHA512
  
  9e055653ed04bdc636c2a4896bae5d3f302aceb10fee928990ad9293e153cf10d0584989c0829ff22ba55dab030da235f73bf892fe6a95dfe76a9f7bdbba1c5c
- SSDEEP
  
  96:2aF21ws2kP5ja86z2ziWoSSUKBccccc3cc2yYBfagsaXeKjJZgchWzZUOkgi:2ak1w3kPhbDAvccccc3cc25avaXncccu
Score

3^/10
behavioral2