Overview

overview

10

Static

static

10

2025-04-10...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-10_da18a26759ba8756886abf05193e7e00_amadey_elex_rhadamanthys_smoke-loader

  • Size

    400KB

  • Sample

    250410-qynqkssyh1

  • MD5

    da18a26759ba8756886abf05193e7e00

  • SHA1

    ef0b29f650fd828398f07b904e6069db15515b68

  • SHA256

    86f2d7930f47a8a607a93da799b173aa3dfd34f8d61a40916e937e45d3c9bcc4

  • SHA512

    030aa1285309dbe9dffb44a302a70daa57606c49d04a6b3d5db7e08e92cf60e755d2a1bb471ba17dd3ae3d9599532c40c56a18322c08f0670a2e86286251f7a4

  • SSDEEP

    12288:Jf7W942o8wE39uW8wESByvNv54B9f01Zm:R7j2o8wDW8wQvr4B9f01Zm

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2025-04-10_da18a26759ba8756886abf05193e7e00_amadey_elex_rhadamanthys_smoke-loader

    • Size

      400KB

    • MD5

      da18a26759ba8756886abf05193e7e00

    • SHA1

      ef0b29f650fd828398f07b904e6069db15515b68

    • SHA256

      86f2d7930f47a8a607a93da799b173aa3dfd34f8d61a40916e937e45d3c9bcc4

    • SHA512

      030aa1285309dbe9dffb44a302a70daa57606c49d04a6b3d5db7e08e92cf60e755d2a1bb471ba17dd3ae3d9599532c40c56a18322c08f0670a2e86286251f7a4

    • SSDEEP

      12288:Jf7W942o8wE39uW8wESByvNv54B9f01Zm:R7j2o8wDW8wQvr4B9f01Zm

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks