Overview

overview

10

Static

static

3

584f89aa9a...fN.exe

windows7-x64

10

584f89aa9a...fN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    584f89aa9aa0c015bb4f35d7a1723ac6aa21015ec25fb1e5045f6eb604e92dbfN

  • Size

    95KB

  • Sample

    240921-bf94jaxhqp

  • MD5

    a8b7a80083b7e294ee2918c950ba82b0

  • SHA1

    9aa3fa6e945f359bc0ecdf396f2e3a4f922e6ab8

  • SHA256

    584f89aa9aa0c015bb4f35d7a1723ac6aa21015ec25fb1e5045f6eb604e92dbf

  • SHA512

    6d267a4e210791b779640e39a24907bbe80df7a307fd2fbe44df2a6cb32ebb6c9f23d38bd89160e16d73f74d6cf81b07fb206eeb0f5cd476fbced37ebb31fc2a

  • SSDEEP

    1536:AwM6B4Q1flO0stWUMRN3oC7hmUo9pWAJR6XfnI4oy8TRQrSRVRoRch1dROrwpOua:zFB4QatWrNY4mfpWSM6euTWM1dQrTOwJ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      584f89aa9aa0c015bb4f35d7a1723ac6aa21015ec25fb1e5045f6eb604e92dbfN

    • Size

      95KB

    • MD5

      a8b7a80083b7e294ee2918c950ba82b0

    • SHA1

      9aa3fa6e945f359bc0ecdf396f2e3a4f922e6ab8

    • SHA256

      584f89aa9aa0c015bb4f35d7a1723ac6aa21015ec25fb1e5045f6eb604e92dbf

    • SHA512

      6d267a4e210791b779640e39a24907bbe80df7a307fd2fbe44df2a6cb32ebb6c9f23d38bd89160e16d73f74d6cf81b07fb206eeb0f5cd476fbced37ebb31fc2a

    • SSDEEP

      1536:AwM6B4Q1flO0stWUMRN3oC7hmUo9pWAJR6XfnI4oy8TRQrSRVRoRch1dROrwpOua:zFB4QatWrNY4mfpWSM6euTWM1dQrTOwJ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks