Overview

overview

10

Static

static

3

7d9f6f9123...bN.exe

windows7-x64

10

7d9f6f9123...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d9f6f9123a62c865774e9f268491d9250021d87cbfe8c4473cf105a71e9c33bN

  • Size

    276KB

  • Sample

    240919-hxtw7swhmm

  • MD5

    e85b385d5c5459ac26f8ac890884e680

  • SHA1

    3c2a6637d0edb1e3c2e7bb6a8fb50cc8f9207079

  • SHA256

    7d9f6f9123a62c865774e9f268491d9250021d87cbfe8c4473cf105a71e9c33b

  • SHA512

    1a45079f479b0e77475053293793d7d6b0598b2b9896476082436774ce16c0cfce2d3b7d5830202d76cc56e8967f794d2c92b77bd9df4ba092f498635c07b4e2

  • SSDEEP

    6144:J5pjBHzunh5AXdWZHEFJ7aWN1rtMsQBOSGaF+:J53zunh5c2HEGWN1RMs1S7

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7d9f6f9123a62c865774e9f268491d9250021d87cbfe8c4473cf105a71e9c33bN

    • Size

      276KB

    • MD5

      e85b385d5c5459ac26f8ac890884e680

    • SHA1

      3c2a6637d0edb1e3c2e7bb6a8fb50cc8f9207079

    • SHA256

      7d9f6f9123a62c865774e9f268491d9250021d87cbfe8c4473cf105a71e9c33b

    • SHA512

      1a45079f479b0e77475053293793d7d6b0598b2b9896476082436774ce16c0cfce2d3b7d5830202d76cc56e8967f794d2c92b77bd9df4ba092f498635c07b4e2

    • SSDEEP

      6144:J5pjBHzunh5AXdWZHEFJ7aWN1rtMsQBOSGaF+:J53zunh5c2HEGWN1RMs1S7

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks