Overview

overview

10

Static

static

3

59462343d6...4N.exe

windows7-x64

10

59462343d6...4N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    59462343d670cc3fcce936dd03c4f90a68c2ccfe6a18ff98c4c8da6d7e482704N

  • Size

    304KB

  • Sample

    240927-ft7msazcpa

  • MD5

    f2c79740dc7e28de3948903d995005f0

  • SHA1

    d1e2d5b538826d24786f50b2971b3f827a9cfc44

  • SHA256

    59462343d670cc3fcce936dd03c4f90a68c2ccfe6a18ff98c4c8da6d7e482704

  • SHA512

    debb5e59e6b2c1141ed05bd403b5c2e7abd52ba7a614389138ff22f72c6bb0d2de0fbb6bdfc880d02d1dc3cf265bf9e611e0056a6603fad4efa97973de08b1de

  • SSDEEP

    3072:euXflAGX6zxHOgwZDeOejz+k5rD0LZSnulc0VP7SnHjg:9XflATzxHOgwZqOEKIrD0Lu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      59462343d670cc3fcce936dd03c4f90a68c2ccfe6a18ff98c4c8da6d7e482704N

    • Size

      304KB

    • MD5

      f2c79740dc7e28de3948903d995005f0

    • SHA1

      d1e2d5b538826d24786f50b2971b3f827a9cfc44

    • SHA256

      59462343d670cc3fcce936dd03c4f90a68c2ccfe6a18ff98c4c8da6d7e482704

    • SHA512

      debb5e59e6b2c1141ed05bd403b5c2e7abd52ba7a614389138ff22f72c6bb0d2de0fbb6bdfc880d02d1dc3cf265bf9e611e0056a6603fad4efa97973de08b1de

    • SSDEEP

      3072:euXflAGX6zxHOgwZDeOejz+k5rD0LZSnulc0VP7SnHjg:9XflATzxHOgwZqOEKIrD0Lu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks