Overview

overview

10

Static

static

3

9aa8cd9832...2N.exe

windows7-x64

10

9aa8cd9832...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aa8cd9832d4df2112ab821b4265ebef836e3e3b51e7cf3ec1130d4b716ccd42N

  • Size

    347KB

  • Sample

    240921-xfkpjaxdqa

  • MD5

    8a4386dc5aaf8c91c98e57ab58c57ab0

  • SHA1

    fc87b894e5c62bb41f098d5aa07826a3eb315627

  • SHA256

    9aa8cd9832d4df2112ab821b4265ebef836e3e3b51e7cf3ec1130d4b716ccd42

  • SHA512

    71a6c44de8369aa30750039fe29125e4ff38a682e97d6578f73515afab5b38d3eceaa3e0caf081a2f09e37bf55420229801fbf478a31247d761240d394ab8923

  • SSDEEP

    6144:wvX51zqth7G5vx4brq2Ah1FM6234lKm3mo8Yvi4KsLTFM6234lKm3qk9:wv51zGh7Ax4brRGFB24lwR45FB24lEk

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9aa8cd9832d4df2112ab821b4265ebef836e3e3b51e7cf3ec1130d4b716ccd42N

    • Size

      347KB

    • MD5

      8a4386dc5aaf8c91c98e57ab58c57ab0

    • SHA1

      fc87b894e5c62bb41f098d5aa07826a3eb315627

    • SHA256

      9aa8cd9832d4df2112ab821b4265ebef836e3e3b51e7cf3ec1130d4b716ccd42

    • SHA512

      71a6c44de8369aa30750039fe29125e4ff38a682e97d6578f73515afab5b38d3eceaa3e0caf081a2f09e37bf55420229801fbf478a31247d761240d394ab8923

    • SSDEEP

      6144:wvX51zqth7G5vx4brq2Ah1FM6234lKm3mo8Yvi4KsLTFM6234lKm3qk9:wv51zGh7Ax4brRGFB24lwR45FB24lEk

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks