Overview

overview

10

Static

static

3

e53f62bb5d...2N.exe

windows7-x64

10

e53f62bb5d...2N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932N

  • Size

    80KB

  • Sample

    240919-p662fszapc

  • MD5

    96b6d403d26e34fab90f091b1c7cdb30

  • SHA1

    df7880c339922fb46b4495ce6078f5ab4a4e1e6d

  • SHA256

    e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932

  • SHA512

    0524961cf28e25db9a8898c3de8e3c2e1d96343e89f62b8f0f7ec2396ba5e262a30c832914398065025ed99e5d49f3293d006fe149cd85247b6f512871106ba8

  • SSDEEP

    1536:6Y7yiNIPc5P1zQaYBywyFmPywZyPUOWaPtRL2VFeJuqnhCN:scPDYB7TbUWqKVFeJLCN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932N

    • Size

      80KB

    • MD5

      96b6d403d26e34fab90f091b1c7cdb30

    • SHA1

      df7880c339922fb46b4495ce6078f5ab4a4e1e6d

    • SHA256

      e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932

    • SHA512

      0524961cf28e25db9a8898c3de8e3c2e1d96343e89f62b8f0f7ec2396ba5e262a30c832914398065025ed99e5d49f3293d006fe149cd85247b6f512871106ba8

    • SSDEEP

      1536:6Y7yiNIPc5P1zQaYBywyFmPywZyPUOWaPtRL2VFeJuqnhCN:scPDYB7TbUWqKVFeJLCN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks