Overview

overview

10

Static

static

10

db498cebfc...5N.exe

windows7-x64

10

db498cebfc...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db498cebfc99d31e302d525a79313b35561e054c2b099ed144486302d2911205N

  • Size

    337KB

  • Sample

    241010-wrz3xsvcml

  • MD5

    bc02b85677250fef556359ba606c91d0

  • SHA1

    6497ad4064f317c641e9aeeca408da05682878c8

  • SHA256

    db498cebfc99d31e302d525a79313b35561e054c2b099ed144486302d2911205

  • SHA512

    6d77b4ac060b17ad8b91f91f2ac058e238a170f7b36c04bfe4c94e50dc807f68b4447314080089901e8aa64f96403b9baaa093d7279cb886876241c9b3d8cf85

  • SSDEEP

    3072:GTm3uALBCn4Xd8tZxBgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:4IRt8tZb1+fIyG5jZkCwi8r

Score
10/10
berbewnjratbackdoordiscoverypersistencetrojan

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      db498cebfc99d31e302d525a79313b35561e054c2b099ed144486302d2911205N

    • Size

      337KB

    • MD5

      bc02b85677250fef556359ba606c91d0

    • SHA1

      6497ad4064f317c641e9aeeca408da05682878c8

    • SHA256

      db498cebfc99d31e302d525a79313b35561e054c2b099ed144486302d2911205

    • SHA512

      6d77b4ac060b17ad8b91f91f2ac058e238a170f7b36c04bfe4c94e50dc807f68b4447314080089901e8aa64f96403b9baaa093d7279cb886876241c9b3d8cf85

    • SSDEEP

      3072:GTm3uALBCn4Xd8tZxBgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:4IRt8tZb1+fIyG5jZkCwi8r

    Score
    10/10
    berbewnjratbackdoordiscoverypersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks