Overview

overview

10

Static

static

3

49dd1964ab...bN.exe

windows7-x64

10

49dd1964ab...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49dd1964abe7afe6b157975e22f42e8454494abbd84f0c7cb69e724db7f8a8ebN

  • Size

    82KB

  • Sample

    241010-ksw7waxhnk

  • MD5

    f54fbafe466933827a30f2c7fac127c0

  • SHA1

    ac9fb25cc64205c6d340660af2644436bd2926f8

  • SHA256

    49dd1964abe7afe6b157975e22f42e8454494abbd84f0c7cb69e724db7f8a8eb

  • SHA512

    3c15ed4dced43411e38e3c6dbc500d30144a5fb120fe8af365859a29dbe2652cc8056fd083ff0c053e6d2f6f6aa4856000922018bdf5dfd8e3335dba53b9b04b

  • SSDEEP

    1536:bnHCIoQ1Yi8Ecs2HBVuXr2L73Dpm6+wDSmQFN6TiN1sJtvQu:+1YYiVUHhnpm6tm7N6TO1SpD

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      49dd1964abe7afe6b157975e22f42e8454494abbd84f0c7cb69e724db7f8a8ebN

    • Size

      82KB

    • MD5

      f54fbafe466933827a30f2c7fac127c0

    • SHA1

      ac9fb25cc64205c6d340660af2644436bd2926f8

    • SHA256

      49dd1964abe7afe6b157975e22f42e8454494abbd84f0c7cb69e724db7f8a8eb

    • SHA512

      3c15ed4dced43411e38e3c6dbc500d30144a5fb120fe8af365859a29dbe2652cc8056fd083ff0c053e6d2f6f6aa4856000922018bdf5dfd8e3335dba53b9b04b

    • SSDEEP

      1536:bnHCIoQ1Yi8Ecs2HBVuXr2L73Dpm6+wDSmQFN6TiN1sJtvQu:+1YYiVUHhnpm6tm7N6TO1SpD

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.