Overview

overview

10

Static

static

3

e96aaf916a...7N.exe

windows7-x64

10

e96aaf916a...7N.exe

windows10-2004-x64

10

Resubmissions

26-10-2024 07:33

241026-jdn3aa1hme 10

26-10-2024 06:50

241026-hmb9easelk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e96aaf916a525158ec1d33141c3c138efa1cd21a4b1821b8b5fab42681e02f17N

  • Size

    397KB

  • Sample

    241026-jdn3aa1hme

  • MD5

    dd109acf062351007336d2ff5173d960

  • SHA1

    f2991dbea0e6e7ff0e272bb8f54f971365e0dafe

  • SHA256

    e96aaf916a525158ec1d33141c3c138efa1cd21a4b1821b8b5fab42681e02f17

  • SHA512

    ca42a64b4838c36600b0f2ffdae57e731fa8be58cce2e8a95d50ae3285bc8680c0586e6eb1d0ef927a4b684db4bf13406177d5be0a5eba01245bb6e88222a386

  • SSDEEP

    6144:rVFahK2hJaPFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz1581hW:/WAFB24lwR45FB24lzx1skz15L

Score
10/10
berbewinfinitylockbackdoordiscoverypersistenceransomware

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e96aaf916a525158ec1d33141c3c138efa1cd21a4b1821b8b5fab42681e02f17N

    • Size

      397KB

    • MD5

      dd109acf062351007336d2ff5173d960

    • SHA1

      f2991dbea0e6e7ff0e272bb8f54f971365e0dafe

    • SHA256

      e96aaf916a525158ec1d33141c3c138efa1cd21a4b1821b8b5fab42681e02f17

    • SHA512

      ca42a64b4838c36600b0f2ffdae57e731fa8be58cce2e8a95d50ae3285bc8680c0586e6eb1d0ef927a4b684db4bf13406177d5be0a5eba01245bb6e88222a386

    • SSDEEP

      6144:rVFahK2hJaPFM6234lKm3mo8Yvi4KsLTFM6234lKm3pT11Tgkz1581hW:/WAFB24lwR45FB24lzx1skz15L

    Score
    10/10
    berbewbackdoordiscoverypersistenceinfinitylockransomware

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • InfinityLock Ransomware

      Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

      ransomwareinfinitylock

    • Infinitylock family

      infinitylock

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks