Overview

overview

10

Static

static

3

df674a90eb...aN.exe

windows7-x64

10

df674a90eb...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df674a90eb0a2f4789e48e1bccd98a565867069c16239fdf023f0c49f8046b2aN

  • Size

    112KB

  • Sample

    240930-y8qxpaxfqc

  • MD5

    b6928b448260ae3aa456fa761cc1fc90

  • SHA1

    5879017ff958c03719983ed8e17a8e00eec2f37b

  • SHA256

    df674a90eb0a2f4789e48e1bccd98a565867069c16239fdf023f0c49f8046b2a

  • SHA512

    b4b6b749991054164b7c45d0298f1656cc79f368c7f62e728f014a6d2c76116445e7d0a0e94c1aa5d91c9f49e5b70aa39c25fa29d9f65228ffd34f093465f9b3

  • SSDEEP

    1536:bXamy3c6TPgyLLW2ufz42cXVmZcTgnoEeikRynlypv8LIuCseNIQ:b63c6gfz42cXVmZcTme+lc802eSQ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      df674a90eb0a2f4789e48e1bccd98a565867069c16239fdf023f0c49f8046b2aN

    • Size

      112KB

    • MD5

      b6928b448260ae3aa456fa761cc1fc90

    • SHA1

      5879017ff958c03719983ed8e17a8e00eec2f37b

    • SHA256

      df674a90eb0a2f4789e48e1bccd98a565867069c16239fdf023f0c49f8046b2a

    • SHA512

      b4b6b749991054164b7c45d0298f1656cc79f368c7f62e728f014a6d2c76116445e7d0a0e94c1aa5d91c9f49e5b70aa39c25fa29d9f65228ffd34f093465f9b3

    • SSDEEP

      1536:bXamy3c6TPgyLLW2ufz42cXVmZcTgnoEeikRynlypv8LIuCseNIQ:b63c6gfz42cXVmZcTme+lc802eSQ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks