berbew | 1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

1efa91d298...72.exe

windows7-x64

1efa91d298...72.exe

windows10-2004-x64

Sharing

General

Target

1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72.exe
Size

96KB
Sample

241202-pzblzazjfq
MD5

49e4eaf5e2417827ccb7609970b56b58
SHA1

ed0d2da3c52ea33ea93a5b17e53d70a4fa7806ca
SHA256

1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72
SHA512

530dc1ed1b86f380a9f678d5f8b87041967c3b564dbc2233eb248c71d1cdf17de0780b87581ac73470c55c2a53834944c634a150319ade8d952f90a5fffdb962
SSDEEP

1536:/6BPxPf2DlSG+XgcoeXn/W8Th0WL1r7mUBTzy0EA2Ln7RZObZUUWaegPYAG:yLXh316xnClUUWaed

Score

10^/10

berbew bruteratel backdoor discovery persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72.exe

Resource

win7-20240903-en

berbew bruteratel backdoor discovery persistence

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72.exe

Resource

win10v2004-20241007-en

berbew bruteratel backdoor discovery persistence

windows10-2004-x64

12 signatures

120 seconds

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

http://kadet.ru/index.htm

http://cvv.ru/index.htm

http://crutop.nu/index.htm

http://crutop.ru/index.htm

http://mazafaka.ru/index.htm

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://kidos-bank.ru/index.htm

http://kavkaz.ru/index.htm

http://fethard.biz/index.htm

Targets

- Target
  
  1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72.exe
- Size
  
  96KB
- MD5
  
  49e4eaf5e2417827ccb7609970b56b58
- SHA1
  
  ed0d2da3c52ea33ea93a5b17e53d70a4fa7806ca
- SHA256
  
  1efa91d298a6c8c247d84335b63fa71210897dc7a64ed7ee029f01841cb25c72
- SHA512
  
  530dc1ed1b86f380a9f678d5f8b87041967c3b564dbc2233eb248c71d1cdf17de0780b87581ac73470c55c2a53834944c634a150319ade8d952f90a5fffdb962
- SSDEEP
  
  1536:/6BPxPf2DlSG+XgcoeXn/W8Th0WL1r7mUBTzy0EA2Ln7RZObZUUWaegPYAG:yLXh316xnClUUWaed
Score

10^/10

berbew bruteratel backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Brute Ratel C4
  A customized command and control framework for red teaming and adversary simulation.
  backdoor bruteratel
- Bruteratel family
  bruteratel
- Detect BruteRatel badger
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbruteratelbackdoordiscoverypersistence

behavioral2

berbewbruteratelbackdoordiscoverypersistence

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.