berbew | 787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

787f40735f...4N.exe

windows7-x64

787f40735f...4N.exe

windows10-2004-x64

Sharing

General

Target

787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204N
Size

96KB
Sample

241104-1rc1lsxmfy
MD5

71f995cbd903a07da5d64a72e49b88e0
SHA1

6388bf09337cb83034c97a50e9026db9211e8dc1
SHA256

787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204
SHA512

231c6d91013824427a2d014bb0e0d5845a3abf56c324fd9cf52392049daf9fb3c4a67219067d5112b25c2c86752377a1adeb66e0615e8291258bf7d05d58c78e
SSDEEP

1536:pjedS+imLJt4p242Lg07RZObZUUWaegPYA:I1t4wJRClUUWae

Score

10^/10

berbew bruteratel backdoor discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204N.exe

Resource

win7-20240903-en

berbew bruteratel backdoor discovery persistence

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204N.exe

Resource

win10v2004-20241007-en

berbew bruteratel backdoor discovery persistence

windows10-2004-x64

12 signatures

120 seconds

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

http://kadet.ru/index.htm

http://cvv.ru/index.htm

http://crutop.nu/index.htm

http://crutop.ru/index.htm

http://mazafaka.ru/index.htm

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://kidos-bank.ru/index.htm

http://kavkaz.ru/index.htm

http://fethard.biz/index.htm

Targets

- Target
  
  787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204N
- Size
  
  96KB
- MD5
  
  71f995cbd903a07da5d64a72e49b88e0
- SHA1
  
  6388bf09337cb83034c97a50e9026db9211e8dc1
- SHA256
  
  787f40735fd6b4c87801019f38a8f4daf43d00474a84ac16de82d67809827204
- SHA512
  
  231c6d91013824427a2d014bb0e0d5845a3abf56c324fd9cf52392049daf9fb3c4a67219067d5112b25c2c86752377a1adeb66e0615e8291258bf7d05d58c78e
- SSDEEP
  
  1536:pjedS+imLJt4p242Lg07RZObZUUWaegPYA:I1t4wJRClUUWae
Score

10^/10

berbew bruteratel backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Brute Ratel C4
  A customized command and control framework for red teaming and adversary simulation.
  backdoor bruteratel
- Bruteratel family
  bruteratel
- Detect BruteRatel badger
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbruteratelbackdoordiscoverypersistence

behavioral2

berbewbruteratelbackdoordiscoverypersistence

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.