Overview

overview

10

Static

static

3

8e91feba9b...5N.exe

windows7-x64

10

8e91feba9b...5N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e91feba9b3cac4490fbfb907284b4af64337d4cd8834378239a0eb905210a25N

  • Size

    74KB

  • Sample

    240930-hl3pza1dqk

  • MD5

    b125c08300b5c48201ea2d49b2327030

  • SHA1

    a7547d5cf297415fe53e5c9772324ea5de10b783

  • SHA256

    8e91feba9b3cac4490fbfb907284b4af64337d4cd8834378239a0eb905210a25

  • SHA512

    7fcda3ac2a2d0a51506a6ed7042c43db5f5b6d59f020acafb68d277a4046ccf4f53d508be52bb006b9df5aaa73a189b4c5bd1996bb867a25197f65b6ce69b977

  • SSDEEP

    768:ZqnpdxSBksvio+Y55gsan7W1OpmQC1eaQY0eUhaAqeo/elYgvQbLqmnOB6+jBA6W:4n4P55gsg7C13bt11gvuLqmeBAkr

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8e91feba9b3cac4490fbfb907284b4af64337d4cd8834378239a0eb905210a25N

    • Size

      74KB

    • MD5

      b125c08300b5c48201ea2d49b2327030

    • SHA1

      a7547d5cf297415fe53e5c9772324ea5de10b783

    • SHA256

      8e91feba9b3cac4490fbfb907284b4af64337d4cd8834378239a0eb905210a25

    • SHA512

      7fcda3ac2a2d0a51506a6ed7042c43db5f5b6d59f020acafb68d277a4046ccf4f53d508be52bb006b9df5aaa73a189b4c5bd1996bb867a25197f65b6ce69b977

    • SSDEEP

      768:ZqnpdxSBksvio+Y55gsan7W1OpmQC1eaQY0eUhaAqeo/elYgvQbLqmnOB6+jBA6W:4n4P55gsg7C13bt11gvuLqmeBAkr

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks