Overview

overview

10

Static

static

3

70360cd342...3N.exe

windows7-x64

10

70360cd342...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70360cd3421e18f14d48a5d60ead7f1f2ec26dc8f6da00ea1155c443f06c4993N

  • Size

    80KB

  • Sample

    240919-ebnarazclp

  • MD5

    56f0c2fe44cb9ffc39fea631ff9e4c90

  • SHA1

    98249c9716fec2193d6928f49aeeda99c1573497

  • SHA256

    70360cd3421e18f14d48a5d60ead7f1f2ec26dc8f6da00ea1155c443f06c4993

  • SHA512

    cc903b100e4db35fef23e9014dcc309466b2e5c8c3966b5da32a88d425c1e56373d33120a4c49f9ab9ada6598661ff9b2dafe381f44501cf0e086e724151933b

  • SSDEEP

    1536:UnENavNkX8XRuSwq8P42KvWy/lJ+Pz7JXkHgjf/HPH3qIbxUXCEFeJuqnhCN:Dcvu2gSSP42KvzlJ6HJXkATPH3nqyEFx

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      70360cd3421e18f14d48a5d60ead7f1f2ec26dc8f6da00ea1155c443f06c4993N

    • Size

      80KB

    • MD5

      56f0c2fe44cb9ffc39fea631ff9e4c90

    • SHA1

      98249c9716fec2193d6928f49aeeda99c1573497

    • SHA256

      70360cd3421e18f14d48a5d60ead7f1f2ec26dc8f6da00ea1155c443f06c4993

    • SHA512

      cc903b100e4db35fef23e9014dcc309466b2e5c8c3966b5da32a88d425c1e56373d33120a4c49f9ab9ada6598661ff9b2dafe381f44501cf0e086e724151933b

    • SSDEEP

      1536:UnENavNkX8XRuSwq8P42KvWy/lJ+Pz7JXkHgjf/HPH3qIbxUXCEFeJuqnhCN:Dcvu2gSSP42KvzlJ6HJXkATPH3nqyEFx

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks