Overview

overview

10

Static

static

3

78fe7710ed...0N.exe

windows7-x64

10

78fe7710ed...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78fe7710ed18205211fb9fd34aef774c53ecac08068a2a8904262f10730a6340N

  • Size

    163KB

  • Sample

    241102-2ppgasxfmh

  • MD5

    eb8dad31b62d32765f573c651f0a0590

  • SHA1

    250cc95a2d5510af11bfb5e459cfbbbc0e20e817

  • SHA256

    78fe7710ed18205211fb9fd34aef774c53ecac08068a2a8904262f10730a6340

  • SHA512

    76ff8f78ae03f59b84a2e7cd440068370a8c5f15de5b767483dc26544ef7ddd67dadf83b651ca6de2d657c6aa9cec0cd6dae650b1f5c8605b67d18c80064df6c

  • SSDEEP

    1536:PxFUmtL7qucxI/TbzIVA23bMeRG2EjPlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:Y6L71jC4L2EjPltOrWKDBr+yJb

Score
10/10
berbewgozibackdoorbankerdiscoveryisfbpersistencetrojan

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Targets

    • Target

      78fe7710ed18205211fb9fd34aef774c53ecac08068a2a8904262f10730a6340N

    • Size

      163KB

    • MD5

      eb8dad31b62d32765f573c651f0a0590

    • SHA1

      250cc95a2d5510af11bfb5e459cfbbbc0e20e817

    • SHA256

      78fe7710ed18205211fb9fd34aef774c53ecac08068a2a8904262f10730a6340

    • SHA512

      76ff8f78ae03f59b84a2e7cd440068370a8c5f15de5b767483dc26544ef7ddd67dadf83b651ca6de2d657c6aa9cec0cd6dae650b1f5c8605b67d18c80064df6c

    • SSDEEP

      1536:PxFUmtL7qucxI/TbzIVA23bMeRG2EjPlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:Y6L71jC4L2EjPltOrWKDBr+yJb

    Score
    10/10
    berbewbackdoordiscoverypersistencegozibankerisfbtrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

      bankertrojangozi

    • Gozi family

      gozi

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks