Overview

overview

10

Static

static

3

c3a5a4701b...5N.exe

windows7-x64

10

c3a5a4701b...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3a5a4701b8dcb9b81a6bd3056f1ea7884ee1444231e9a4e15729f851a3e82b5N

  • Size

    300KB

  • Sample

    241009-yts4haxcka

  • MD5

    7b336fc1aede4a955d98983719f39500

  • SHA1

    bf9d80373da7801bb96c8c0853d21bbec3615cd0

  • SHA256

    c3a5a4701b8dcb9b81a6bd3056f1ea7884ee1444231e9a4e15729f851a3e82b5

  • SHA512

    f4ed8b97c917e6424cc22a006dfbe534b53c3abf4be4cb107c2afee395b29e3b1d7b7419241f8be5346d615491a604dd8048cf2cddca0df7db4fe3a902fd8da1

  • SSDEEP

    6144:rG+v1p46lLkE7DvqufhcmoZjwszeXmr8SeNpgdyuH1l+/Wd:PRlLkE7ymCjb87g4/c

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      c3a5a4701b8dcb9b81a6bd3056f1ea7884ee1444231e9a4e15729f851a3e82b5N

    • Size

      300KB

    • MD5

      7b336fc1aede4a955d98983719f39500

    • SHA1

      bf9d80373da7801bb96c8c0853d21bbec3615cd0

    • SHA256

      c3a5a4701b8dcb9b81a6bd3056f1ea7884ee1444231e9a4e15729f851a3e82b5

    • SHA512

      f4ed8b97c917e6424cc22a006dfbe534b53c3abf4be4cb107c2afee395b29e3b1d7b7419241f8be5346d615491a604dd8048cf2cddca0df7db4fe3a902fd8da1

    • SSDEEP

      6144:rG+v1p46lLkE7DvqufhcmoZjwszeXmr8SeNpgdyuH1l+/Wd:PRlLkE7ymCjb87g4/c

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks