Overview

overview

10

Static

static

3

a1a91e3190...0N.exe

windows7-x64

10

a1a91e3190...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1a91e3190ccbd77730eb00cb440596e75a6801a3341b6236b430401f2dd2bd0N

  • Size

    94KB

  • Sample

    240921-lj277swakk

  • MD5

    51674b29a72a6d7ca87c735463ff1980

  • SHA1

    2e86eba1ebf01378bef9f40e2d8f0e227da52471

  • SHA256

    a1a91e3190ccbd77730eb00cb440596e75a6801a3341b6236b430401f2dd2bd0

  • SHA512

    a1936cf000421acc77080c7dbbc187f13c504e4da783508a44ec3f7dc886bfd7b5a1a5de4e0739358af75c3e69f757a48106d449cc92572b24f4660ee34df0d4

  • SSDEEP

    1536:TP78unhz+OsNX8JELr24eE5XS2to7dMeye0TnxMRVkeyyVr3iwcH2ogHx:cuRsNsOldo3ye0Ti3kremwc/gHx

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a1a91e3190ccbd77730eb00cb440596e75a6801a3341b6236b430401f2dd2bd0N

    • Size

      94KB

    • MD5

      51674b29a72a6d7ca87c735463ff1980

    • SHA1

      2e86eba1ebf01378bef9f40e2d8f0e227da52471

    • SHA256

      a1a91e3190ccbd77730eb00cb440596e75a6801a3341b6236b430401f2dd2bd0

    • SHA512

      a1936cf000421acc77080c7dbbc187f13c504e4da783508a44ec3f7dc886bfd7b5a1a5de4e0739358af75c3e69f757a48106d449cc92572b24f4660ee34df0d4

    • SSDEEP

      1536:TP78unhz+OsNX8JELr24eE5XS2to7dMeye0TnxMRVkeyyVr3iwcH2ogHx:cuRsNsOldo3ye0Ti3kremwc/gHx

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks