Overview

overview

10

Static

static

3

8e14753fbd...ae.exe

windows7-x64

10

8e14753fbd...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e14753fbdab252048330a5032cf23747d5c8aed4f4225ef6b74d05eaeefefae

  • Size

    352KB

  • Sample

    240925-3vf8jsxgmb

  • MD5

    e37e54c6ff30ebe730ba131a3abb7acd

  • SHA1

    5db05ca97f5fcc88dfb4ee001980c8dbf9fc7de9

  • SHA256

    8e14753fbdab252048330a5032cf23747d5c8aed4f4225ef6b74d05eaeefefae

  • SHA512

    c0e0db40f023865794a9d41bfb3899e3535edee4599c79a522318645ac4cefba324e7dbd4d5fb3c77f1f9d2af2101c27286636c07950cf6b42180e90e838b8db

  • SSDEEP

    6144:xvy6ZvytnJfKXqPTX7D7FM6234lKm3mo8Yvi4KsLTFM6234lKm3cM9:fAtJCXqP77D7FB24lwR45FB24lqM

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8e14753fbdab252048330a5032cf23747d5c8aed4f4225ef6b74d05eaeefefae

    • Size

      352KB

    • MD5

      e37e54c6ff30ebe730ba131a3abb7acd

    • SHA1

      5db05ca97f5fcc88dfb4ee001980c8dbf9fc7de9

    • SHA256

      8e14753fbdab252048330a5032cf23747d5c8aed4f4225ef6b74d05eaeefefae

    • SHA512

      c0e0db40f023865794a9d41bfb3899e3535edee4599c79a522318645ac4cefba324e7dbd4d5fb3c77f1f9d2af2101c27286636c07950cf6b42180e90e838b8db

    • SSDEEP

      6144:xvy6ZvytnJfKXqPTX7D7FM6234lKm3mo8Yvi4KsLTFM6234lKm3cM9:fAtJCXqP77D7FB24lwR45FB24lqM

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks