berbew | 18a30a9b227abb5398a49724474851007a7b304c5315e0f85b59bb616968c35d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18a30a9b227abb5398a49724474851007a7b304c5315e0f85b59bb616968c35dN.exe
Size

59KB
Sample

240925-n3ay6sxcle
MD5

5b5ebb4f62b4723b7f02cacdf97df540
SHA1

35f04d6fa7efa95de5495665b89911bcac465bc1
SHA256

18a30a9b227abb5398a49724474851007a7b304c5315e0f85b59bb616968c35d
SHA512

0351858351a91ea1bb1c13d533ceb855c982d9410e61b39c6d4668efc0d3871ec1883a89705ca1fe3a4574a9fc34ac3cbaca4288b7361e9429d90293c64c2274
SSDEEP

768:h31iPSkWSTe2CMrGrSYkHXH4gvKsPTp4k5Umg6lDsfiEkaTIZ/1H5T5nf1fZMEBv:h31mSOCMiOYtwvPTpbUmTlDNz/NCyVso

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Targets

- Target
  
  18a30a9b227abb5398a49724474851007a7b304c5315e0f85b59bb616968c35dN.exe
- Size
  
  59KB
- MD5
  
  5b5ebb4f62b4723b7f02cacdf97df540
- SHA1
  
  35f04d6fa7efa95de5495665b89911bcac465bc1
- SHA256
  
  18a30a9b227abb5398a49724474851007a7b304c5315e0f85b59bb616968c35d
- SHA512
  
  0351858351a91ea1bb1c13d533ceb855c982d9410e61b39c6d4668efc0d3871ec1883a89705ca1fe3a4574a9fc34ac3cbaca4288b7361e9429d90293c64c2274
- SSDEEP
  
  768:h31iPSkWSTe2CMrGrSYkHXH4gvKsPTp4k5Umg6lDsfiEkaTIZ/1H5T5nf1fZMEBv:h31mSOCMiOYtwvPTpbUmTlDNz/NCyVso
Score

10^/10

berbew backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbackdoordiscoverypersistence

behavioral2

berbewbackdoordiscoverypersistence