General

  • Target

    virussign.com_20241119_LimitedFree.zip

  • Size

    28.7MB

  • Sample

    241210-nrvt7szjem

  • MD5

    48c21d10f951b48941820cff2e23607b

  • SHA1

    9850a5f66a33e0fd54558bcfc1683b343924f104

  • SHA256

    1367de9ed9b6b8cb138b9d8860dcda9a7b4c17209dcbe90acb775f5ad26d5d4c

  • SHA512

    42691e3538c0e1127f64dd3654fdfa31c6c01c35d1068f0550d9eacb831054b641d2ffd0187deef327e8235552e971080deaa5ce860eb8ec0bd47a9e74a744b4

  • SSDEEP

    786432:ihW2jsqbW84Uo58MBH1wEtP93hiV3ZLhLfeBRg3kN+/j:iM2hW84h98EF9oV3NhLGjk7

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Targets

    • Target

      virussign.com_20241119_LimitedFree.zip

    • Size

      28.7MB

    • MD5

      48c21d10f951b48941820cff2e23607b

    • SHA1

      9850a5f66a33e0fd54558bcfc1683b343924f104

    • SHA256

      1367de9ed9b6b8cb138b9d8860dcda9a7b4c17209dcbe90acb775f5ad26d5d4c

    • SHA512

      42691e3538c0e1127f64dd3654fdfa31c6c01c35d1068f0550d9eacb831054b641d2ffd0187deef327e8235552e971080deaa5ce860eb8ec0bd47a9e74a744b4

    • SSDEEP

      786432:ihW2jsqbW84Uo58MBH1wEtP93hiV3ZLhLfeBRg3kN+/j:iM2hW84h98EF9oV3NhLGjk7

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Detects MyDoom family

    • Floxif family

    • Floxif, Floodfix

      Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    • MyDoom

      MyDoom is a Worm that is written in C++.

    • Mydoom family

    • Simda family

    • Xmrig family

    • simda

      Simda is an infostealer written in C++.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Detects Floxif payload

    • XMRig Miner payload

    • Event Triggered Execution: AppInit DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks