Overview

overview

10

Static

static

3

20073c7751...dN.exe

windows7-x64

10

20073c7751...dN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    20073c775175b49e8d94014126186276d014a3bba9ff863edd8c53a1a56d959dN

  • Size

    357KB

  • Sample

    241001-pdl6kssfnb

  • MD5

    90b63e49e52cb3b1ffd3b522e0e8d5e0

  • SHA1

    75f6a4d070ff85f3cb69a9b3a6bc6f1c63d57538

  • SHA256

    20073c775175b49e8d94014126186276d014a3bba9ff863edd8c53a1a56d959d

  • SHA512

    a5cd81ee2b7798f73b580f61ae4ef716aaabfc73847c468f9f2c10ca38893cb5597d1e9c6808a41fd5adc16c3d79a3d3b9217814a5d9f50f7488369e9a708ba1

  • SSDEEP

    6144:wV3oi8uM7WZDB1n6xJmPMwZoXpKtCe8AUReheFlfSZR0SvsuFrGoyeg3kl+fiXFf:a4v1GHZoXpKtCe1eehil6ZR5ZrQeg3kj

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      20073c775175b49e8d94014126186276d014a3bba9ff863edd8c53a1a56d959dN

    • Size

      357KB

    • MD5

      90b63e49e52cb3b1ffd3b522e0e8d5e0

    • SHA1

      75f6a4d070ff85f3cb69a9b3a6bc6f1c63d57538

    • SHA256

      20073c775175b49e8d94014126186276d014a3bba9ff863edd8c53a1a56d959d

    • SHA512

      a5cd81ee2b7798f73b580f61ae4ef716aaabfc73847c468f9f2c10ca38893cb5597d1e9c6808a41fd5adc16c3d79a3d3b9217814a5d9f50f7488369e9a708ba1

    • SSDEEP

      6144:wV3oi8uM7WZDB1n6xJmPMwZoXpKtCe8AUReheFlfSZR0SvsuFrGoyeg3kl+fiXFf:a4v1GHZoXpKtCe1eehil6ZR5ZrQeg3kj

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks