Overview

overview

10

Static

static

3

68365b8853...dN.exe

windows7-x64

10

68365b8853...dN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    68365b88535015ff10625380b901e3f84d17f5d5f30b0c388c5881b69db7b0ddN

  • Size

    269KB

  • Sample

    240919-n2dcxaxepm

  • MD5

    becfd4dbe3b0df926c6daa7bc23822c0

  • SHA1

    24ff70ccc1156ff5323d09270bfc849126c08bdd

  • SHA256

    68365b88535015ff10625380b901e3f84d17f5d5f30b0c388c5881b69db7b0dd

  • SHA512

    ed20ad2edaf00a01969b882511730a16d083ee2905da9f00d87b518ba209890e183b01061f813be859f8ad2de04203a795b9e71fe36d54a9d971c4965e985452

  • SSDEEP

    6144:6nvDPsmoSJDX4EYtCwGtMtkiXOoloMr1JeSldqP7+x55Kmj50GXoCcmASBTw2AX4:Asd5ChtMtkM71r1MSXqPix55KI5fX/c+

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      68365b88535015ff10625380b901e3f84d17f5d5f30b0c388c5881b69db7b0ddN

    • Size

      269KB

    • MD5

      becfd4dbe3b0df926c6daa7bc23822c0

    • SHA1

      24ff70ccc1156ff5323d09270bfc849126c08bdd

    • SHA256

      68365b88535015ff10625380b901e3f84d17f5d5f30b0c388c5881b69db7b0dd

    • SHA512

      ed20ad2edaf00a01969b882511730a16d083ee2905da9f00d87b518ba209890e183b01061f813be859f8ad2de04203a795b9e71fe36d54a9d971c4965e985452

    • SSDEEP

      6144:6nvDPsmoSJDX4EYtCwGtMtkiXOoloMr1JeSldqP7+x55Kmj50GXoCcmASBTw2AX4:Asd5ChtMtkM71r1MSXqPix55KI5fX/c+

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks