berbew

General

Target

8c2152ca7622a39ae72e107024767389127e6fa9f1e1fddf2ed0eaab8c280180
Size

364KB
Sample

250305-f75qcazwc1
MD5

b6ff05e72885f2aeba2423b7adcc46f4
SHA1

21ddf9f41f1a824d92cb95a4776b641dbf5293f5
SHA256

8c2152ca7622a39ae72e107024767389127e6fa9f1e1fddf2ed0eaab8c280180
SHA512

7dcc4ca3984e4308f40808e9fca045366eee0339cfebc2b15bd61ae188d6a3efc2c3f3001aff8f45df1e183d57afc32fbf53d36d96da9c106e37bb654ca64304
SSDEEP

1536:9xzXF8CvrJ4PBhDP35w6hklProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Ph8k6DP3y6hkltOrWKDBr+yJb

Score

10^/10

Malware Config

Extracted

Family

berbew

C2

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Targets

- Target
  
  8c2152ca7622a39ae72e107024767389127e6fa9f1e1fddf2ed0eaab8c280180
- Size
  
  364KB
- MD5
  
  b6ff05e72885f2aeba2423b7adcc46f4
- SHA1
  
  21ddf9f41f1a824d92cb95a4776b641dbf5293f5
- SHA256
  
  8c2152ca7622a39ae72e107024767389127e6fa9f1e1fddf2ed0eaab8c280180
- SHA512
  
  7dcc4ca3984e4308f40808e9fca045366eee0339cfebc2b15bd61ae188d6a3efc2c3f3001aff8f45df1e183d57afc32fbf53d36d96da9c106e37bb654ca64304
- SSDEEP
  
  1536:9xzXF8CvrJ4PBhDP35w6hklProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Ph8k6DP3y6hkltOrWKDBr+yJb
Score

10^/10

berbew backdoor gozi banker discovery isfb trojan
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Gozi family
  gozi
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Berbew family

Gozi

Gozi family

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2