Overview

overview

10

Static

static

3

079e102e06...01.exe

windows7-x64

10

079e102e06...01.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    079e102e069fc7260c4a0673cdf7cd81b72fb60793044493dce354245e43bc01

  • Size

    128KB

  • Sample

    240925-wzxb1azell

  • MD5

    f5b5931006b865bf0d2876c50fb1059c

  • SHA1

    43cf46a971ab95b5988dd9bd96bb8438a6044e56

  • SHA256

    079e102e069fc7260c4a0673cdf7cd81b72fb60793044493dce354245e43bc01

  • SHA512

    1c33b228c5d01df298c2d99f7c10ab17d00404561879f07ba11fe9cc9313a09dc84fdd876b15c75da46b69b3174a3172f3ddfd6efb8f9c3b0940d5e2e5cb3d44

  • SSDEEP

    3072:KuVDzhXYK+316r1TWOicn72aofeilj9pui6yYPaI7DehizrVtN:f7HTlN7c2epui6yYPaIGc

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      079e102e069fc7260c4a0673cdf7cd81b72fb60793044493dce354245e43bc01

    • Size

      128KB

    • MD5

      f5b5931006b865bf0d2876c50fb1059c

    • SHA1

      43cf46a971ab95b5988dd9bd96bb8438a6044e56

    • SHA256

      079e102e069fc7260c4a0673cdf7cd81b72fb60793044493dce354245e43bc01

    • SHA512

      1c33b228c5d01df298c2d99f7c10ab17d00404561879f07ba11fe9cc9313a09dc84fdd876b15c75da46b69b3174a3172f3ddfd6efb8f9c3b0940d5e2e5cb3d44

    • SSDEEP

      3072:KuVDzhXYK+316r1TWOicn72aofeilj9pui6yYPaI7DehizrVtN:f7HTlN7c2epui6yYPaIGc

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks