Overview

overview

10

Static

static

3

31416b14ff...5N.exe

windows7-x64

10

31416b14ff...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31416b14ff1a8dbf8a2526ed9341f42e51278c6bb0cad99a801b23910b9f0405N.exe

  • Size

    923KB

  • Sample

    241207-zs8y1ayncr

  • MD5

    c49c61695260983fe4b6e92f7bf0af70

  • SHA1

    c4f37b5963f7d8fb45195dfd164fd59f9fe41728

  • SHA256

    31416b14ff1a8dbf8a2526ed9341f42e51278c6bb0cad99a801b23910b9f0405

  • SHA512

    02243e7aaa22b9c1b2aa46d996bf38225e0e00ed29ae1984b37924875daa7a71c43b4d630411d6ee757a0ce1c1346b75d600b6b03b6d6d5b5ca1818c51f51b28

  • SSDEEP

    12288:AZqfg1/Ng1/Nmr/Ng1/Nblt01PBNkEoIa:AZqfgelkcEpa

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      31416b14ff1a8dbf8a2526ed9341f42e51278c6bb0cad99a801b23910b9f0405N.exe

    • Size

      923KB

    • MD5

      c49c61695260983fe4b6e92f7bf0af70

    • SHA1

      c4f37b5963f7d8fb45195dfd164fd59f9fe41728

    • SHA256

      31416b14ff1a8dbf8a2526ed9341f42e51278c6bb0cad99a801b23910b9f0405

    • SHA512

      02243e7aaa22b9c1b2aa46d996bf38225e0e00ed29ae1984b37924875daa7a71c43b4d630411d6ee757a0ce1c1346b75d600b6b03b6d6d5b5ca1818c51f51b28

    • SSDEEP

      12288:AZqfg1/Ng1/Nmr/Ng1/Nblt01PBNkEoIa:AZqfgelkcEpa

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks