Overview

overview

10

Static

static

10

bf5261f001...a9.exe

windows7-x64

10

bf5261f001...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf5261f001d6477cdba8d520616c41a9.exe

  • Size

    121KB

  • Sample

    240426-mccjmsec3y

  • MD5

    bf5261f001d6477cdba8d520616c41a9

  • SHA1

    801b3ca4733aef8c0422639ebad64e7c0bd68391

  • SHA256

    8c4f90bdfa08bfeffa9e24af90c843335d2949e507d103a981ccd85119a83e58

  • SHA512

    447edfa7a2bde6791933c947b036f178faf1dae854b241aa767a2facf41c726a5cd9b8ee4ccaceca313d4c9caea3d9ae6e9ff074e16edb03ec60bf81477a5660

  • SSDEEP

    1536:DeOpv5LV6nisuYwejikD0H7Yd91qq+luJfgR0T9CV19zQYOd5ijJnD5ir3oGuiWP:Djl5INwu0H7W1yg5w0TsO7AJnD5tvv

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      bf5261f001d6477cdba8d520616c41a9.exe

    • Size

      121KB

    • MD5

      bf5261f001d6477cdba8d520616c41a9

    • SHA1

      801b3ca4733aef8c0422639ebad64e7c0bd68391

    • SHA256

      8c4f90bdfa08bfeffa9e24af90c843335d2949e507d103a981ccd85119a83e58

    • SHA512

      447edfa7a2bde6791933c947b036f178faf1dae854b241aa767a2facf41c726a5cd9b8ee4ccaceca313d4c9caea3d9ae6e9ff074e16edb03ec60bf81477a5660

    • SSDEEP

      1536:DeOpv5LV6nisuYwejikD0H7Yd91qq+luJfgR0T9CV19zQYOd5ijJnD5ir3oGuiWP:Djl5INwu0H7W1yg5w0TsO7AJnD5tvv

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks