Overview

overview

10

Static

static

10

fd9d379c89...6d.exe

windows7-x64

10

fd9d379c89...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd9d379c89a133f0c9a2cca4ed6420002542e5e539b926f41163d0e41daf666d

  • Size

    104KB

  • Sample

    240919-ecnynszaqb

  • MD5

    d5057a6cf81a2c8714fa8f284d4862a8

  • SHA1

    42989c3ca5a05bf289bdd6ee5f1a6168a6e24428

  • SHA256

    fd9d379c89a133f0c9a2cca4ed6420002542e5e539b926f41163d0e41daf666d

  • SHA512

    886d8b305755228c4489a7430270d319980a329e0ed4bd446f0d02224b98fafaa57fea2549b019a5ed8e8b559a0d2a4a49d15cf75bba2d1399d0401d9b1959b5

  • SSDEEP

    3072:PBMfAd1Zz5q3i569e+30366e5Hx7cEGrhkngpDvchkqbAIQ:PBvV5Ki569N46R5Hx4brq2Ah

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fd9d379c89a133f0c9a2cca4ed6420002542e5e539b926f41163d0e41daf666d

    • Size

      104KB

    • MD5

      d5057a6cf81a2c8714fa8f284d4862a8

    • SHA1

      42989c3ca5a05bf289bdd6ee5f1a6168a6e24428

    • SHA256

      fd9d379c89a133f0c9a2cca4ed6420002542e5e539b926f41163d0e41daf666d

    • SHA512

      886d8b305755228c4489a7430270d319980a329e0ed4bd446f0d02224b98fafaa57fea2549b019a5ed8e8b559a0d2a4a49d15cf75bba2d1399d0401d9b1959b5

    • SSDEEP

      3072:PBMfAd1Zz5q3i569e+30366e5Hx7cEGrhkngpDvchkqbAIQ:PBvV5Ki569N46R5Hx4brq2Ah

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks