Overview

overview

10

Static

static

3

44b09ed3d8...6N.exe

windows7-x64

10

44b09ed3d8...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44b09ed3d811038655568f40a60ba88c3ab5136a4483d59a188f14d510fce196N.exe

  • Size

    81KB

  • Sample

    241208-cnpm8swrew

  • MD5

    f87c6ffbe130e4ae8795c3e86ee26020

  • SHA1

    4e9e2a52ba2336dce1045d38b1f472c1356fbf39

  • SHA256

    44b09ed3d811038655568f40a60ba88c3ab5136a4483d59a188f14d510fce196

  • SHA512

    81c8e0933ac4acc4ccc5117972e6d66c379145deb072c5573abf40dba4229bd7748289d0e5085783a1ec8c2c84bfcfa186cfb41b0b849bf64538d00ff17ab034

  • SSDEEP

    1536:BcOERpH/98s5XtYpE/nZUAy/H1uugjIvayBtXJwBAmDk7m4LO++/+1m6KadhYxUT:Ls5XtnZ7y/H1uugjIBZw6Uk/LrCimBaT

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      44b09ed3d811038655568f40a60ba88c3ab5136a4483d59a188f14d510fce196N.exe

    • Size

      81KB

    • MD5

      f87c6ffbe130e4ae8795c3e86ee26020

    • SHA1

      4e9e2a52ba2336dce1045d38b1f472c1356fbf39

    • SHA256

      44b09ed3d811038655568f40a60ba88c3ab5136a4483d59a188f14d510fce196

    • SHA512

      81c8e0933ac4acc4ccc5117972e6d66c379145deb072c5573abf40dba4229bd7748289d0e5085783a1ec8c2c84bfcfa186cfb41b0b849bf64538d00ff17ab034

    • SSDEEP

      1536:BcOERpH/98s5XtYpE/nZUAy/H1uugjIvayBtXJwBAmDk7m4LO++/+1m6KadhYxUT:Ls5XtnZ7y/H1uugjIBZw6Uk/LrCimBaT

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks