Overview

overview

10

Static

static

3

42fa4175da...5N.exe

windows7-x64

10

42fa4175da...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42fa4175dab0b29f9e44b817c6dd7e87abcf668422acc92fc2a9a2b6289e05d5N.exe

  • Size

    96KB

  • Sample

    241210-gyb74s1khl

  • MD5

    5b2d57855336a917e4f11389f9e87470

  • SHA1

    7c324211e3eeadd3fdbbc621724a2966180770b8

  • SHA256

    42fa4175dab0b29f9e44b817c6dd7e87abcf668422acc92fc2a9a2b6289e05d5

  • SHA512

    9394975c140c12f935889986befce91f47106b31dc69c6a318d95aead1c4b306495b266bde43f16dbf7a1cdb0636032a0b9aefabf2501ee267cbcb5b04c7c811

  • SSDEEP

    1536:kKzoR50MDsBDpE07cZvV75WxKxvP8dsFWFwCBDy4NCBYajUABmkP6Mq7rllqUOc+:3zgbqE07cZvV75Wx88dssyFBxjUSmkCu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      42fa4175dab0b29f9e44b817c6dd7e87abcf668422acc92fc2a9a2b6289e05d5N.exe

    • Size

      96KB

    • MD5

      5b2d57855336a917e4f11389f9e87470

    • SHA1

      7c324211e3eeadd3fdbbc621724a2966180770b8

    • SHA256

      42fa4175dab0b29f9e44b817c6dd7e87abcf668422acc92fc2a9a2b6289e05d5

    • SHA512

      9394975c140c12f935889986befce91f47106b31dc69c6a318d95aead1c4b306495b266bde43f16dbf7a1cdb0636032a0b9aefabf2501ee267cbcb5b04c7c811

    • SSDEEP

      1536:kKzoR50MDsBDpE07cZvV75WxKxvP8dsFWFwCBDy4NCBYajUABmkP6Mq7rllqUOc+:3zgbqE07cZvV75Wx88dssyFBxjUSmkCu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks