berbew | e611053cbb6cdb134bf48c0b66330af2d7b30b6266c20073d2a17151db393cb4 | Triage

Sharing

General

Target

2025-03-29_b5cdc4c9d2ea8e4a0c1fcd5d0f1b72ec_amadey_rhadamanthys_smoke-loader
Size

400KB
Sample

250329-l2bszasnt5
MD5

b5cdc4c9d2ea8e4a0c1fcd5d0f1b72ec
SHA1

19f0a9c133115863a3bf530df0dd22f2de7dbe21
SHA256

e611053cbb6cdb134bf48c0b66330af2d7b30b6266c20073d2a17151db393cb4
SHA512

410ceb12454d32b9f0ed2ccfbc68484131c93ebcb41971b9b08d3bcdb6cb54a68d90ad8b9b14287b6b3523a102a7515c2e78f65b894519535be334f11260e702
SSDEEP

12288:Q7/af2o8wE39uW8wESByvNv54B9f01Zm:QLaf2o8wDW8wQvr4B9f01Zm

Score

10^/10

berbew bruteratel backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

- Target
  
  2025-03-29_b5cdc4c9d2ea8e4a0c1fcd5d0f1b72ec_amadey_rhadamanthys_smoke-loader
- Size
  
  400KB
- MD5
  
  b5cdc4c9d2ea8e4a0c1fcd5d0f1b72ec
- SHA1
  
  19f0a9c133115863a3bf530df0dd22f2de7dbe21
- SHA256
  
  e611053cbb6cdb134bf48c0b66330af2d7b30b6266c20073d2a17151db393cb4
- SHA512
  
  410ceb12454d32b9f0ed2ccfbc68484131c93ebcb41971b9b08d3bcdb6cb54a68d90ad8b9b14287b6b3523a102a7515c2e78f65b894519535be334f11260e702
- SSDEEP
  
  12288:Q7/af2o8wE39uW8wESByvNv54B9f01Zm:QLaf2o8wDW8wQvr4B9f01Zm
Score

10^/10

berbew backdoor discovery persistence bruteratel
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Brute Ratel C4
  A customized command and control framework for red teaming and adversary simulation.
  backdoor bruteratel
- Bruteratel family
  bruteratel
- Detect BruteRatel badger
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbackdoordiscoverypersistence

behavioral2

berbewbruteratelbackdoordiscoverypersistence