Overview

overview

10

Static

static

3

758a552d0c...a4.exe

windows7-x64

10

758a552d0c...a4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    758a552d0c42e5bbcf41bcb4cd731ca47f900de5ef58833c8ed5f3706089f9a4

  • Size

    96KB

  • Sample

    241004-3g67taxajc

  • MD5

    af98efd43971ddbefbfa409f229aef42

  • SHA1

    281f9dc958736406c5aeeacf7688a96dc7e83f40

  • SHA256

    758a552d0c42e5bbcf41bcb4cd731ca47f900de5ef58833c8ed5f3706089f9a4

  • SHA512

    747c839d385871b88208f29b4726ad20fbbfc4a1901e2a019a8569374594284e1de208b8eadc644d31cf2cc5a35c0c31715f16f2eae774d6b7099f53a15a4fe6

  • SSDEEP

    1536:gsvhRYCxe+/hTJxKtla2L97RZObZUUWaegPYA:xZKCp/hTJx49ClUUWae

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      758a552d0c42e5bbcf41bcb4cd731ca47f900de5ef58833c8ed5f3706089f9a4

    • Size

      96KB

    • MD5

      af98efd43971ddbefbfa409f229aef42

    • SHA1

      281f9dc958736406c5aeeacf7688a96dc7e83f40

    • SHA256

      758a552d0c42e5bbcf41bcb4cd731ca47f900de5ef58833c8ed5f3706089f9a4

    • SHA512

      747c839d385871b88208f29b4726ad20fbbfc4a1901e2a019a8569374594284e1de208b8eadc644d31cf2cc5a35c0c31715f16f2eae774d6b7099f53a15a4fe6

    • SSDEEP

      1536:gsvhRYCxe+/hTJxKtla2L97RZObZUUWaegPYA:xZKCp/hTJx49ClUUWae

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.