Overview

overview

10

Static

static

10

7839f0e703...25.exe

windows7-x64

10

7839f0e703...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7839f0e7036b2c0f980b9c4a316cc9fcd55802b360185b0a393afccd13f29025

  • Size

    337KB

  • Sample

    250123-c24djsyqal

  • MD5

    a103b9a07c607c51ea7086d1c2646b76

  • SHA1

    d57b2a5e32d76b443d51adec7cd323d9d48e008a

  • SHA256

    7839f0e7036b2c0f980b9c4a316cc9fcd55802b360185b0a393afccd13f29025

  • SHA512

    9d3b8abae89c99503698d7fe2c21aa33e1189e8a78e3b190e2949c2612acbf3fb938483b33a71bc294b6440d2b61cbbd2e860c051c1f1d621854ee474d8c410e

  • SSDEEP

    3072:SEsH2BitjlZpJzcjyxwKgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:SEK2OwK1+fIyG5jZkCwi8r

Score
10/10
berbewnjratbackdoordiscoverypersistencetrojan

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Targets

    • Target

      7839f0e7036b2c0f980b9c4a316cc9fcd55802b360185b0a393afccd13f29025

    • Size

      337KB

    • MD5

      a103b9a07c607c51ea7086d1c2646b76

    • SHA1

      d57b2a5e32d76b443d51adec7cd323d9d48e008a

    • SHA256

      7839f0e7036b2c0f980b9c4a316cc9fcd55802b360185b0a393afccd13f29025

    • SHA512

      9d3b8abae89c99503698d7fe2c21aa33e1189e8a78e3b190e2949c2612acbf3fb938483b33a71bc294b6440d2b61cbbd2e860c051c1f1d621854ee474d8c410e

    • SSDEEP

      3072:SEsH2BitjlZpJzcjyxwKgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:SEK2OwK1+fIyG5jZkCwi8r

    Score
    10/10
    berbewnjratbackdoordiscoverypersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.