Overview

overview

10

Static

static

3

b46a85f429...dN.exe

windows7-x64

10

b46a85f429...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b46a85f429d8a9aaa7c7ba539b75091b2f8fc54895aad8fee1aa64d85cdadaedN

  • Size

    96KB

  • Sample

    241022-xswybsscjp

  • MD5

    c688fe7896b98a648a45ff93f87e5ee0

  • SHA1

    25ef2b59ab904a44ba51e987fa52f60ba76f41be

  • SHA256

    b46a85f429d8a9aaa7c7ba539b75091b2f8fc54895aad8fee1aa64d85cdadaed

  • SHA512

    ed419410a15cb499e20446844207be82cb99afa09ce3b0c4620f03a042f90da9e5e86866763665ff3b7e592a3ae3effa7d6e37aa9db3a6c98c3f0a24d55fd763

  • SSDEEP

    1536:V6UEzutU6mMHHsodOPmJwOHMBnCH/jNKWSRaXU2LD7RZObZUUWaegPYA:VO/rMnXAmJwOsxA/jEWSRoDClUUWae

Score
10/10
berbewbruteratelbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      b46a85f429d8a9aaa7c7ba539b75091b2f8fc54895aad8fee1aa64d85cdadaedN

    • Size

      96KB

    • MD5

      c688fe7896b98a648a45ff93f87e5ee0

    • SHA1

      25ef2b59ab904a44ba51e987fa52f60ba76f41be

    • SHA256

      b46a85f429d8a9aaa7c7ba539b75091b2f8fc54895aad8fee1aa64d85cdadaed

    • SHA512

      ed419410a15cb499e20446844207be82cb99afa09ce3b0c4620f03a042f90da9e5e86866763665ff3b7e592a3ae3effa7d6e37aa9db3a6c98c3f0a24d55fd763

    • SSDEEP

      1536:V6UEzutU6mMHHsodOPmJwOHMBnCH/jNKWSRaXU2LD7RZObZUUWaegPYA:VO/rMnXAmJwOsxA/jEWSRoDClUUWae

    Score
    10/10
    berbewbruteratelbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • Detect BruteRatel badger

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks