Overview

overview

10

Static

static

3

7bef7e11f3...cN.exe

windows7-x64

10

7bef7e11f3...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7bef7e11f3f6cd4314654a82888316e24f8c6d1a7684085bc6f035ca6638bc8cN.exe

  • Size

    60KB

  • Sample

    241207-m6vx3szmd1

  • MD5

    7c5d0efb9608a9bc6f8b515708f1dc90

  • SHA1

    6c74db83bfd0d8e60540daf2dc1a8af83e463d47

  • SHA256

    7bef7e11f3f6cd4314654a82888316e24f8c6d1a7684085bc6f035ca6638bc8c

  • SHA512

    8db5ed788eb0169e09d303a02271e43dc2142cc4c0881c97c3a60afd04554f6728781cbcaeb69dac3bdd9b9844b10c3b20e821f850034627ba3d806f75aa4f1e

  • SSDEEP

    1536:DafEgoILrF00SrmU7Q4wFs8j5Kaii7OB86l1r:b6ry0Sr64wFsa5Ii7OB86l1r

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      7bef7e11f3f6cd4314654a82888316e24f8c6d1a7684085bc6f035ca6638bc8cN.exe

    • Size

      60KB

    • MD5

      7c5d0efb9608a9bc6f8b515708f1dc90

    • SHA1

      6c74db83bfd0d8e60540daf2dc1a8af83e463d47

    • SHA256

      7bef7e11f3f6cd4314654a82888316e24f8c6d1a7684085bc6f035ca6638bc8c

    • SHA512

      8db5ed788eb0169e09d303a02271e43dc2142cc4c0881c97c3a60afd04554f6728781cbcaeb69dac3bdd9b9844b10c3b20e821f850034627ba3d806f75aa4f1e

    • SSDEEP

      1536:DafEgoILrF00SrmU7Q4wFs8j5Kaii7OB86l1r:b6ry0Sr64wFsa5Ii7OB86l1r

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks