Overview

overview

10

Static

static

3

0bca7e24f2...cN.exe

windows7-x64

10

0bca7e24f2...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0bca7e24f20a5ec37848d721b889956eeee8e7201bccc27315c6502338962becN

  • Size

    128KB

  • Sample

    241004-cnzs7syglm

  • MD5

    f4168d259ab2d5aa4016633c3d397620

  • SHA1

    0d1e35885ebc9d57d79d8861cc1863c72b4ff1e9

  • SHA256

    0bca7e24f20a5ec37848d721b889956eeee8e7201bccc27315c6502338962bec

  • SHA512

    53c1a32f2587412b4a2ae8ba59b887bd12c6e02f6d0d48dd375a915871391051cf62fd62ae64dd95bbb28dbcf763699a3f3db5a5e0356ffea6f7ec2f4ff70cae

  • SSDEEP

    3072:E1XNFytJqw7V184Leiw0v0wnJcefSXQHPTTAkvB5DdcgFM9o:EZTItnJfKXqPTX7D7FMm

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0bca7e24f20a5ec37848d721b889956eeee8e7201bccc27315c6502338962becN

    • Size

      128KB

    • MD5

      f4168d259ab2d5aa4016633c3d397620

    • SHA1

      0d1e35885ebc9d57d79d8861cc1863c72b4ff1e9

    • SHA256

      0bca7e24f20a5ec37848d721b889956eeee8e7201bccc27315c6502338962bec

    • SHA512

      53c1a32f2587412b4a2ae8ba59b887bd12c6e02f6d0d48dd375a915871391051cf62fd62ae64dd95bbb28dbcf763699a3f3db5a5e0356ffea6f7ec2f4ff70cae

    • SSDEEP

      3072:E1XNFytJqw7V184Leiw0v0wnJcefSXQHPTTAkvB5DdcgFM9o:EZTItnJfKXqPTX7D7FMm

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks