Overview

overview

10

Static

static

10

Backdoor.W...SK.exe

windows7-x64

10

Backdoor.W...SK.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Backdoor.Win32.Padodor.SK.MTB-bbc582dbe8ef14efea30ed35d70e90caa750da926983bc0ef093a8eda3f7d2b5N

  • Size

    128KB

  • Sample

    240919-e4zjgs1erq

  • MD5

    7b57936fff3e438ebb90d2939c4e00c0

  • SHA1

    81c97fb9376b505f1120df17678e8b7385065bce

  • SHA256

    bbc582dbe8ef14efea30ed35d70e90caa750da926983bc0ef093a8eda3f7d2b5

  • SHA512

    4c93a9e41ddf80c71cea6622c4c07e3382415b72ea166a5e90024e28db069e046f580086ce6909450ca0956860d70dfaee527210f1d4574c6a44620db1b799e0

  • SSDEEP

    1536:f+v9G4v+lcK33jcJ7I2CXstgJrBfGzRQDfRfRa9HprmRfRJCLIXG:IGDlcmWxis2JFeeDf5wkpHxG

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      Backdoor.Win32.Padodor.SK.MTB-bbc582dbe8ef14efea30ed35d70e90caa750da926983bc0ef093a8eda3f7d2b5N

    • Size

      128KB

    • MD5

      7b57936fff3e438ebb90d2939c4e00c0

    • SHA1

      81c97fb9376b505f1120df17678e8b7385065bce

    • SHA256

      bbc582dbe8ef14efea30ed35d70e90caa750da926983bc0ef093a8eda3f7d2b5

    • SHA512

      4c93a9e41ddf80c71cea6622c4c07e3382415b72ea166a5e90024e28db069e046f580086ce6909450ca0956860d70dfaee527210f1d4574c6a44620db1b799e0

    • SSDEEP

      1536:f+v9G4v+lcK33jcJ7I2CXstgJrBfGzRQDfRfRa9HprmRfRJCLIXG:IGDlcmWxis2JFeeDf5wkpHxG

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks