Overview

overview

10

Static

static

3

d8458c00cb...24.exe

windows7-x64

10

d8458c00cb...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8458c00cb222ca298c588e6191da8299ffc462b837e3f157757c4877d175324

  • Size

    198KB

  • Sample

    240920-219xdatckr

  • MD5

    89dabfabc645d75b30e3b2856e5036fc

  • SHA1

    bb60ea7715247f13feb2c1d7bc958eca5a51c0f0

  • SHA256

    d8458c00cb222ca298c588e6191da8299ffc462b837e3f157757c4877d175324

  • SHA512

    34e0997d69276de49c5bf4e89398c22b7ba9657fb6aa5241e9754f84c37a4c225fc4b70aa745ccddc5c86d78e76c140f7ca26edcae24b44e802f8013be3fc39d

  • SSDEEP

    3072:FElgQd4biUaRHiQ4Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrCIwfE:FYVd42NHiQBOHhkym/89bKws

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d8458c00cb222ca298c588e6191da8299ffc462b837e3f157757c4877d175324

    • Size

      198KB

    • MD5

      89dabfabc645d75b30e3b2856e5036fc

    • SHA1

      bb60ea7715247f13feb2c1d7bc958eca5a51c0f0

    • SHA256

      d8458c00cb222ca298c588e6191da8299ffc462b837e3f157757c4877d175324

    • SHA512

      34e0997d69276de49c5bf4e89398c22b7ba9657fb6aa5241e9754f84c37a4c225fc4b70aa745ccddc5c86d78e76c140f7ca26edcae24b44e802f8013be3fc39d

    • SSDEEP

      3072:FElgQd4biUaRHiQ4Sp+7H7wWkqrifbdB7dYk1Bx8DpsV6OzrCIwfE:FYVd42NHiQBOHhkym/89bKws

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks