Overview

overview

10

Static

static

3

785d0070e7...b8.exe

windows7-x64

10

785d0070e7...b8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    785d0070e702ad70023e763c64c54c525431013be400b858642c51d6c3a60ab8

  • Size

    60KB

  • Sample

    241015-a82gesygrq

  • MD5

    da08e62a5680a0b0ce40e0a6762f2c09

  • SHA1

    f37080d737cc6b46a8f2a439ee321bc6cad623c4

  • SHA256

    785d0070e702ad70023e763c64c54c525431013be400b858642c51d6c3a60ab8

  • SHA512

    7f374a40d7ab4651c7cea23bc52f06c235230d2c204097ad92e773074547b4b818681075a0fb86c71824997c693134e4f6d257da704f1ffae1da1af7ae812590

  • SSDEEP

    768:DoTc1lZ6FJ28Y+ui1GAo3lQJyYlZYPokJ7+/XWOZTDTOPsApYCcMA0tTAOoO/1Hk:D/uc8oi1GAsQvHiPsRKJTA3k8B86l1r

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      785d0070e702ad70023e763c64c54c525431013be400b858642c51d6c3a60ab8

    • Size

      60KB

    • MD5

      da08e62a5680a0b0ce40e0a6762f2c09

    • SHA1

      f37080d737cc6b46a8f2a439ee321bc6cad623c4

    • SHA256

      785d0070e702ad70023e763c64c54c525431013be400b858642c51d6c3a60ab8

    • SHA512

      7f374a40d7ab4651c7cea23bc52f06c235230d2c204097ad92e773074547b4b818681075a0fb86c71824997c693134e4f6d257da704f1ffae1da1af7ae812590

    • SSDEEP

      768:DoTc1lZ6FJ28Y+ui1GAo3lQJyYlZYPokJ7+/XWOZTDTOPsApYCcMA0tTAOoO/1Hk:D/uc8oi1GAsQvHiPsRKJTA3k8B86l1r

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks