berbew

Sharing

Copy URL Twitter E-mail

General

Target
DoomRat.exe
Size 12.1MB
Sample240920-v11kdayaqd
SHA256 94bd1fa65b9ee3fe4be830326ebcd918609ee260797391d1af8aa4ac470cce3f
MD5 b6f21ecc31778ba2362958d1e5091759
SHA1 613dbf4e682fe14b8617908113fc5c7ba05de16a
SHA512 d5d842d520fa1a5a768b62e3d4945f7aa49aa3079c78843cc70eb2e87515dc228cd8bda2ecbe70d1cdb8a94630687cefe587ee6dfac93685cd9e17473040ac4d
SSDEEP 393216:HGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:KYQZ2YwUlJn1QtIm28IKzo
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Credentials

Protocol
ftp
Host
feresto.hop.ru
Port
21
Username
w350955
Password
ubz0m0bv

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Extracted

Family

emotet

Botnet

Epoch2

149.202.197.94:8080
139.162.75.91:8080
37.187.2.199:443
165.227.156.155:443
90.77.228.193:8090
67.225.179.64:8080
87.106.139.101:8080
191.92.209.110:7080
83.136.245.190:8080
65.23.154.17:8080
190.211.207.11:443
115.78.95.230:443
190.147.215.53:22
62.75.187.192:8080
173.249.47.77:8080
104.131.44.150:8080
190.145.67.134:8090
138.201.140.110:8080
103.39.131.88:80
80.11.163.139:21
182.176.132.213:8090
5.196.74.210:8080
217.160.182.191:8080
167.99.105.223:7080
87.230.19.21:8080
192.81.213.192:8080
59.103.164.174:80
176.31.200.130:8080
85.104.59.244:20
31.12.67.62:7080
159.65.25.128:8080
212.129.24.79:8080
37.157.194.134:443
181.143.194.138:443
186.4.172.5:20
192.241.255.77:8080
178.210.51.222:8080
186.4.172.5:8080
92.222.216.44:8080
95.128.43.213:8080
144.139.247.220:80
190.226.44.20:21
45.33.49.124:443
181.31.213.158:8080
104.131.11.150:8080
186.4.172.5:443
46.105.131.87:80
104.236.246.93:8080
173.212.203.26:8080
181.57.193.14:80
211.63.71.72:8080
78.24.219.147:8080
94.205.247.10:80
201.250.92.247:50000
31.172.240.91:8080
169.239.182.217:8080
149.202.153.252:8080
183.102.238.69:465
87.106.136.232:8080
167.71.10.37:8080
200.71.148.138:8080
192.241.220.155:8080
91.205.215.66:8080
152.89.236.214:8080
104.239.175.211:8080
178.209.71.63:8080
144.76.56.36:8080
107.170.24.125:8080
189.209.217.49:80
190.53.135.159:21
186.75.241.230:80

rsa_pubkey.plain

Extracted

Family

redline

Botnet

@tankist1007

92.119.113.189:21746

Extracted

Family

emotet

Botnet

Epoch2

38.18.235.242:80
5.196.108.189:8080
121.124.124.40:7080
104.236.246.93:8080
113.61.66.94:80
120.150.60.189:80
91.211.88.52:7080
47.144.21.12:443
108.46.29.236:80
139.162.108.71:8080
134.209.36.254:8080
139.59.60.244:8080
66.65.136.14:80
76.175.162.101:80
174.106.122.139:80
95.213.236.64:8080
174.45.13.118:80
50.35.17.13:80
209.141.54.221:8080
87.106.139.101:8080
96.249.236.156:443
176.111.60.55:8080
85.96.199.93:80
87.106.136.232:8080
97.82.79.83:80
185.94.252.104:443
79.98.24.39:8080
142.112.10.95:20
5.196.74.210:8080
94.1.108.190:443
24.137.76.62:80
121.7.127.163:80
37.139.21.175:8080
213.196.135.145:80
83.169.36.251:8080
24.179.13.119:80
137.59.187.107:8080
181.169.34.190:80
139.130.242.43:80
42.200.107.142:80
140.186.212.146:80
74.208.45.104:8080
188.219.31.12:80
105.186.233.33:80
93.147.212.206:80
194.187.133.160:443
61.19.246.238:443
85.152.162.105:80
5.39.91.110:7080
71.72.196.159:80
24.43.99.75:80
139.162.60.124:8080
124.41.215.226:80
67.10.155.92:80
109.74.5.95:8080
78.187.156.31:80
195.7.12.8:80
187.49.206.134:80
123.176.25.234:80
157.245.99.39:8080
78.188.106.53:443
94.200.114.161:80
94.23.237.171:443
104.251.33.179:80
68.252.26.78:80
75.139.38.211:80
103.86.49.11:8080
62.75.141.82:80
172.104.97.173:8080
79.137.83.50:443
110.142.236.207:80
162.241.242.173:8080
78.24.219.147:8080
91.146.156.228:80
118.83.154.64:443
216.139.123.119:80
121.7.31.214:80
181.169.235.7:80
139.99.158.11:443
172.91.208.86:80
46.105.131.79:8080
104.131.11.150:443
110.145.77.103:80
82.80.155.43:80
168.235.67.138:7080
50.91.114.38:80
137.119.36.33:80
203.153.216.189:7080
37.187.72.193:8080
24.43.32.186:80
130.0.132.242:80
80.241.255.202:8080
220.245.198.194:80
190.240.194.77:443
89.216.122.92:80
1.221.254.82:80
104.131.44.150:8080
62.30.7.67:443

rsa_pubkey.plain

Extracted

Family

xworm

127.0.0.1:39176
20.ip.gl.ply.gg:39176

Attributes

Install_directory
%AppData%
install_file
Explorer.exe

Targets

- Target
  DoomRat.exe
- Size 12.1MB
- SHA256 94bd1fa65b9ee3fe4be830326ebcd918609ee260797391d1af8aa4ac470cce3f
- MD5 b6f21ecc31778ba2362958d1e5091759
- SHA1 613dbf4e682fe14b8617908113fc5c7ba05de16a
- SHA512 d5d842d520fa1a5a768b62e3d4945f7aa49aa3079c78843cc70eb2e87515dc228cd8bda2ecbe70d1cdb8a94630687cefe587ee6dfac93685cd9e17473040ac4d
- SSDEEP 393216:HGV2CSQhZ2YsHFUK2Jn1+TtIiFQS2NXNsI8VbTToP:KYQZ2YwUlJn1QtIm28IKzo
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

berbew blackmoon emotet modiloader redline sectoprat xworm @tankist1007 epoch2 backdoor banker discovery execution infostealer rat trojan upx
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Blackmoon, KrBanker
  Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
  trojan banker blackmoon
- Detect Blackmoon payload
- Detect Xworm Payload
- Emotet
  Emotet is a trojan that is primarily spread through spam emails.
  trojan banker emotet
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Emotet payload
  Detects Emotet payload in memory.
  trojan banker
- ModiLoader Second Stage
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

static1

pyinstalleradware antivm apt backdoor banker bootkit botnet clipper collection crypter discovery downloader dropper evasion exploit exploiter fakeav ics infostealer keylogger loader maldoc miner overlay persistence ransomware rat rootkit spam spreader spyware stealer trojan wiper wormdoomrat

Score

10^/10

behavioral1

berbewblackmoonemotetmodiloaderredlinesectopratxworm@tankist1007epoch2backdoorbankerdiscoveryexecutioninfostealerrattrojanupx

Score

10^/10

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Blackmoon, KrBanker

Detect Blackmoon payload

Detect Xworm Payload

Emotet

ModiLoader, DBatLoader

RedLine

RedLine payload

SectopRAT

SectopRAT payload

Xworm

Emotet payload

ModiLoader Second Stage

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

UPX packed file

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1