MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Berbew


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
SHA3-384 hash: cbcd886c45d512a2f3178a3b7389bd078f347b52cfd7593ad34d0f62911e009ed104e4a99c0efa0d6978d53231526b39
SHA1 hash: 395a35a4c2fc0ee074a49a511216245ccb6aac44
MD5 hash: 6072031207aded9c77345260772bd466
humanhash: leopard-sad-princess-winner
File name:25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
Download: download sample
Signature Berbew
Create hunting rule
File size:167'473 bytes
First seen:2026-06-04 18:41:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c2a87fabf96470db507b2e6b43bd92eb (7 x Berbew)
ssdeep 3072:lTPbIKfAT9zw0uEF8olltOrWKDBr+yJbQ:lTPkKoKIeolLOfQ
Threatray 28 similar samples on MalwareBazaar
TLSH T102F31CEAB3654FECC96CC3B484D78B65D69EF0781CE9E42D4D5DCEB480085981CAAF21
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4504/4/1)
8.4% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter EnthecSolutions
Tags:Berbew enthec exe PE

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-06-04 18:42:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4fefe208-294e-45ef-af60-a5bf2db10618

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69031/
Detection(s):
Win.Trojan.Crypted-29
Create hunting rule

Win.Dropper.Berbew-9106192-0
Create hunting rule

Win.Malware.Qukart-10014566-0
Create hunting rule

Win.Malware.Qukart-10016519-0
Create hunting rule

Win.Malware.Qukart-10016522-0
Create hunting rule

Win.Malware.Qukart-6838239-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a21c70c57b7bf261d60e5a1
Tags:
shellcode berbew packed virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Enabling autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypto exploit overlay packed packed
Link:
https://www.filescan.io/uploads/6a21c70a12da0d249c653367/reports/a0d4746a-8e80-473a-9b82-a894f4e8cf05/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-09T04:24:00Z UTC
Last seen:
2026-06-06T01:42:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Generic HEUR:Trojan.Win32.Agent.gen HEUR:Trojan-Proxy.Win32.Qukart.sb HEUR:Trojan-Proxy.Win32.Qukart.pefng Backdoor.Win32.Padodor.gen Trojan-Proxy.Win32.Qukart.vjh Trojan-Proxy.Win32.Qukart.gen
Link:
https://opentip.kaspersky.com/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5/results?tab=lookup
Malware family:
Qukart
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70178a77-89ed-4a7f-9d0f-d38122ab12da
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5/
Verdict:
Malicious
Threat:
Family.BERBEW
Link:
https://tip.neiki.dev/file/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
Threat name:
Win32.Infostealer.Berbew
Create hunting rule
Status:
Malicious
First seen:
2026-05-07 19:10:45 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
35 of 36 (97.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ewbhxv54vjotqne7pcaofd65lxpvn5elisdebr3bh6nqziu7w62q._file
Verdict:
malicious
Label(s):
berbew
Create hunting rule
Similar samples:
11858c3aec12012c581a84bd650531412246e41c945f34b20463c049591f401d
Berbew
159fa1c75e3cd476c21013d683ee2d28b63e40323208bf223f34105b3736864b
Berbew
613f491b7e281653d092a0b7a71a8f3bdda7bd73a715065e0eaa075ef641dbe9
Berbew
88bae1978dc015e364b7e52a917b26ee45b02b671ba5aeeabb09116d786e00eb
Berbew
903fefbf3ad797ba2aea3fc720f7f2d65f50430a2e1c18d39057148e4f12c7a5
Berbew
ab409572b7ad47110bc7897ac59814dc9186328a98e0579f8ee6ee0c2000709e
Berbew
error
Berbew
+ 18 additional samples on MalwareBazaar
Result
Malware family:
bruteratel
Create hunting rule
Score:
  10/10
Tags:
family:berbew family:bruteratel backdoor discovery persistence
Link:
https://tria.ge/reports/260604-xcf7yacz2j/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in System32 directory
Executes dropped EXE
Adds autorun key to be loaded by Explorer.exe on startup
Detect BruteRatel badger
Family: Berbew
Family: Brute Ratel C4
Malware Config
C2 Extraction:
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Unpacked files
SH256 hash:
25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5
MD5 hash:
6072031207aded9c77345260772bd466
SHA1 hash:
395a35a4c2fc0ee074a49a511216245ccb6aac44
Link:
https://www.unpac.me/results/18acbab1-6a2d-437c-8bc2-86fe1cd6ff79/
Malware family:
Berbew
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/25827bd7bcaa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25827bd7bcaa5d38349f7880e28fdd5ddf56f48b448640c7613f9b0ca29fb7b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69031/

Comments