Overview

overview

10

Static

static

3

2da93e1166...eN.exe

windows7-x64

10

2da93e1166...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2da93e11666f7f7efb14d67b6646d25bae6374b6d27fbc5d41e459e5a900c78eN.exe

  • Size

    443KB

  • Sample

    241225-wk9zjs1max

  • MD5

    244d07bd3286f8038684cdbb6fe65090

  • SHA1

    04d4cfa78ab6c4258dc195756ef348f5386a812f

  • SHA256

    2da93e11666f7f7efb14d67b6646d25bae6374b6d27fbc5d41e459e5a900c78e

  • SHA512

    3847a114ce4cf18b8f519f7dd7c7e6f769d41896cd40095a98d3c0c3e8dfb12082556af5be4a793bedbd97bc59ee9ef89b9b0e817cfe812f7f4d7c821f7a66a9

  • SSDEEP

    6144:6y03F7x97zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOEB:V01j1J1HJ1Uj+HiPj

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Targets

    • Target

      2da93e11666f7f7efb14d67b6646d25bae6374b6d27fbc5d41e459e5a900c78eN.exe

    • Size

      443KB

    • MD5

      244d07bd3286f8038684cdbb6fe65090

    • SHA1

      04d4cfa78ab6c4258dc195756ef348f5386a812f

    • SHA256

      2da93e11666f7f7efb14d67b6646d25bae6374b6d27fbc5d41e459e5a900c78e

    • SHA512

      3847a114ce4cf18b8f519f7dd7c7e6f769d41896cd40095a98d3c0c3e8dfb12082556af5be4a793bedbd97bc59ee9ef89b9b0e817cfe812f7f4d7c821f7a66a9

    • SSDEEP

      6144:6y03F7x97zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOEB:V01j1J1HJ1Uj+HiPj

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks