Overview

overview

10

Static

static

3

5d044da35d...4N.exe

windows7-x64

10

5d044da35d...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d044da35d6b16f4339a76ad2cf46c35b6827cff39ef146890ceab8b6ac66794N

  • Size

    90KB

  • Sample

    241001-bjvs1stclr

  • MD5

    278e7d220239e805f360a81c35d08240

  • SHA1

    316d94e3b09a76117551af74efd4d45d191f125c

  • SHA256

    5d044da35d6b16f4339a76ad2cf46c35b6827cff39ef146890ceab8b6ac66794

  • SHA512

    15ff8345c816b3b231f9b5c211db400d80c079a56d1da105d0e2bd2b202cf2cb4f62b1a8842fa62230a857a1565e864c0605c0d40a5e3a24a57b908dfae1c7c6

  • SSDEEP

    1536:fGCoDytavjNoaYwo1tnaI1wrGhb4rfhZ7hbx1GZu/Ub0VkVNK:fGCk9BKwg/wrGObVGZu/Ub0+NK

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      5d044da35d6b16f4339a76ad2cf46c35b6827cff39ef146890ceab8b6ac66794N

    • Size

      90KB

    • MD5

      278e7d220239e805f360a81c35d08240

    • SHA1

      316d94e3b09a76117551af74efd4d45d191f125c

    • SHA256

      5d044da35d6b16f4339a76ad2cf46c35b6827cff39ef146890ceab8b6ac66794

    • SHA512

      15ff8345c816b3b231f9b5c211db400d80c079a56d1da105d0e2bd2b202cf2cb4f62b1a8842fa62230a857a1565e864c0605c0d40a5e3a24a57b908dfae1c7c6

    • SSDEEP

      1536:fGCoDytavjNoaYwo1tnaI1wrGhb4rfhZ7hbx1GZu/Ub0VkVNK:fGCk9BKwg/wrGObVGZu/Ub0+NK

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks