Overview

overview

10

Static

static

3

489c139df1...cN.exe

windows7-x64

10

489c139df1...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    489c139df1b1aa08d79d5e74ec1db456373e33c7e5c2cf442649bd3b75fcb59cN

  • Size

    94KB

  • Sample

    241002-xqjvzsvgqg

  • MD5

    cdf5b9b384c32f20b834c5ac4eafa470

  • SHA1

    79b4d90bb5b0bdc3e0041e3256fe24f778557530

  • SHA256

    489c139df1b1aa08d79d5e74ec1db456373e33c7e5c2cf442649bd3b75fcb59c

  • SHA512

    b76aa0e503308d689ab4b264581b0a12b124f1cec440b3516a33177bc5762fc61dde105d0ed2a9e000ae8e80c18567fe072ea1d5ee067e7b24f7fd4991dc4b04

  • SSDEEP

    1536:jR+d+LIIOvbCPeXy/rAdvO284CjtHD+acyJ5/Gwv7okWQnxORVkeyyVr3iwcH2o4:jR+4LIIOzCeSuvm4C5j+acHrQ03kremw

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      489c139df1b1aa08d79d5e74ec1db456373e33c7e5c2cf442649bd3b75fcb59cN

    • Size

      94KB

    • MD5

      cdf5b9b384c32f20b834c5ac4eafa470

    • SHA1

      79b4d90bb5b0bdc3e0041e3256fe24f778557530

    • SHA256

      489c139df1b1aa08d79d5e74ec1db456373e33c7e5c2cf442649bd3b75fcb59c

    • SHA512

      b76aa0e503308d689ab4b264581b0a12b124f1cec440b3516a33177bc5762fc61dde105d0ed2a9e000ae8e80c18567fe072ea1d5ee067e7b24f7fd4991dc4b04

    • SSDEEP

      1536:jR+d+LIIOvbCPeXy/rAdvO284CjtHD+acyJ5/Gwv7okWQnxORVkeyyVr3iwcH2o4:jR+4LIIOzCeSuvm4C5j+acHrQ03kremw

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks