Overview

overview

10

Static

static

3

6873ce736a...f7.exe

windows7-x64

10

6873ce736a...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6873ce736acc45d3a437f393f85d588b7bd8ee4bf10304227d076d51cba859f7

  • Size

    96KB

  • Sample

    241207-3dp45avmbj

  • MD5

    50438e913d0941d1781044050b44683d

  • SHA1

    0e891e11e36cb18b1f886e49120b55c25d9c456d

  • SHA256

    6873ce736acc45d3a437f393f85d588b7bd8ee4bf10304227d076d51cba859f7

  • SHA512

    b8e3c267c54d5b5b8aa31e107e68b5942fdb3af6b8220e8950e46e3ba396e95d23b559d66fd0dc26281f3d198b1253ad93918e18a0e9fab4ffe52c9d491fdf97

  • SSDEEP

    1536:kVKEgCKJxs4kmSnxFvOGYQJiug7ALGrbXvTaAb4NCBYajUABmkP6Mq7rllqUOcyr:AKEV0EGQckGrbX7HbFBxjUSmkCMQ/9hO

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      6873ce736acc45d3a437f393f85d588b7bd8ee4bf10304227d076d51cba859f7

    • Size

      96KB

    • MD5

      50438e913d0941d1781044050b44683d

    • SHA1

      0e891e11e36cb18b1f886e49120b55c25d9c456d

    • SHA256

      6873ce736acc45d3a437f393f85d588b7bd8ee4bf10304227d076d51cba859f7

    • SHA512

      b8e3c267c54d5b5b8aa31e107e68b5942fdb3af6b8220e8950e46e3ba396e95d23b559d66fd0dc26281f3d198b1253ad93918e18a0e9fab4ffe52c9d491fdf97

    • SSDEEP

      1536:kVKEgCKJxs4kmSnxFvOGYQJiug7ALGrbXvTaAb4NCBYajUABmkP6Mq7rllqUOcyr:AKEV0EGQckGrbX7HbFBxjUSmkCMQ/9hO

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks