Overview

overview

10

Static

static

3

415a615c86...6N.exe

windows7-x64

10

415a615c86...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    415a615c8642a649074d49c4adb159df6cfb2bbb851b1a0ce87d6bca355906b6N

  • Size

    844KB

  • Sample

    241002-d35hnsyfja

  • MD5

    2b6968de4cf7e34d5d642bf35c31bb80

  • SHA1

    362f4195658c13da32b53dd096c020a3adda7077

  • SHA256

    415a615c8642a649074d49c4adb159df6cfb2bbb851b1a0ce87d6bca355906b6

  • SHA512

    d5f8a417b5babcc030489a01922043dfc291bf01435f3a161d80cf8b5a2a239f0cdb65850b66e813b499af346d5cb8aef76ce527ab63beb98f2b784962a04bce

  • SSDEEP

    24576:gDpH5W3TnbQihMpQnqrdX72LbY6x46uR/qYglMi:gDpH5W3TbQihw+cdX2x46uhqllMi

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      415a615c8642a649074d49c4adb159df6cfb2bbb851b1a0ce87d6bca355906b6N

    • Size

      844KB

    • MD5

      2b6968de4cf7e34d5d642bf35c31bb80

    • SHA1

      362f4195658c13da32b53dd096c020a3adda7077

    • SHA256

      415a615c8642a649074d49c4adb159df6cfb2bbb851b1a0ce87d6bca355906b6

    • SHA512

      d5f8a417b5babcc030489a01922043dfc291bf01435f3a161d80cf8b5a2a239f0cdb65850b66e813b499af346d5cb8aef76ce527ab63beb98f2b784962a04bce

    • SSDEEP

      24576:gDpH5W3TnbQihMpQnqrdX72LbY6x46uR/qYglMi:gDpH5W3TbQihw+cdX2x46uhqllMi

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks