Overview

overview

10

Static

static

3

1596dea297...85.exe

windows7-x64

10

1596dea297...85.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1596dea29739c5784c062504181feb24769fb1ec52286695f247b7eb4ae2fd85

  • Size

    304KB

  • Sample

    240929-xk95zswdkk

  • MD5

    be250fa1c9d5137a5b92c4a21bf1f286

  • SHA1

    22003916c1f82fc3fdce70f6d78d2abd1748c720

  • SHA256

    1596dea29739c5784c062504181feb24769fb1ec52286695f247b7eb4ae2fd85

  • SHA512

    a524fdb6813a0085b4b6a969a60589222c5af0fe939ad0ae88fee20ef3a503f255c9f5fa9940bf58c161ee2bb7c5faa132d6c8166ecc6edf4ed448561b8a1815

  • SSDEEP

    3072:nhWAvpjP8zdelH8NeAejz+k5rD0LZSnulc0VP7SnHjg:ZvpQz0VvAEKIrD0Lu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      1596dea29739c5784c062504181feb24769fb1ec52286695f247b7eb4ae2fd85

    • Size

      304KB

    • MD5

      be250fa1c9d5137a5b92c4a21bf1f286

    • SHA1

      22003916c1f82fc3fdce70f6d78d2abd1748c720

    • SHA256

      1596dea29739c5784c062504181feb24769fb1ec52286695f247b7eb4ae2fd85

    • SHA512

      a524fdb6813a0085b4b6a969a60589222c5af0fe939ad0ae88fee20ef3a503f255c9f5fa9940bf58c161ee2bb7c5faa132d6c8166ecc6edf4ed448561b8a1815

    • SSDEEP

      3072:nhWAvpjP8zdelH8NeAejz+k5rD0LZSnulc0VP7SnHjg:ZvpQz0VvAEKIrD0Lu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks