Overview

overview

10

Static

static

3

a0fa3fb07b...fN.exe

windows7-x64

10

a0fa3fb07b...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0fa3fb07bfd500561906bb13aa0e2a31757d41e59ccb927f3e31b207342032fN

  • Size

    64KB

  • Sample

    241005-yh1dfawakc

  • MD5

    f2541dc8e6034e9f9dae2e07addd2a90

  • SHA1

    0f9fdc57704ab76486ab9d27f1b3a993b4955c19

  • SHA256

    a0fa3fb07bfd500561906bb13aa0e2a31757d41e59ccb927f3e31b207342032f

  • SHA512

    f49f4deaeb90d7b323f7fe93d26b7f2d6e0d7b6a27c15a354ae9dab41d11bbc6a1ed94ac274fbe43f7e4bf1a30b5dafae62cbe84856950ec7e2851d7be7d47ff

  • SSDEEP

    1536:GbnFwUHwiC/pu1uW6QGuAsc0ABSZuYDPf:oFwUHe/OJUsKSZuY7f

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      a0fa3fb07bfd500561906bb13aa0e2a31757d41e59ccb927f3e31b207342032fN

    • Size

      64KB

    • MD5

      f2541dc8e6034e9f9dae2e07addd2a90

    • SHA1

      0f9fdc57704ab76486ab9d27f1b3a993b4955c19

    • SHA256

      a0fa3fb07bfd500561906bb13aa0e2a31757d41e59ccb927f3e31b207342032f

    • SHA512

      f49f4deaeb90d7b323f7fe93d26b7f2d6e0d7b6a27c15a354ae9dab41d11bbc6a1ed94ac274fbe43f7e4bf1a30b5dafae62cbe84856950ec7e2851d7be7d47ff

    • SSDEEP

      1536:GbnFwUHwiC/pu1uW6QGuAsc0ABSZuYDPf:oFwUHe/OJUsKSZuY7f

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.