Overview

overview

10

Static

static

10

15e9fb4558...bN.exe

windows7-x64

10

15e9fb4558...bN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    15e9fb4558b3010bcccafe2819df8ed048570ab949367b93f1c0f04efb0161fbN

  • Size

    208KB

  • Sample

    241004-k96smszhkb

  • MD5

    dd370823942f13412a3334bf225b1840

  • SHA1

    6af426539b2b0bedee25d88ace5b2a50022b3d89

  • SHA256

    15e9fb4558b3010bcccafe2819df8ed048570ab949367b93f1c0f04efb0161fb

  • SHA512

    fd3f65902481dc1dcdb9648a6f616536cfbf401c9a202a2ea05afc55fca7c17f16c46fbfb0d61b1b3da18cf06924bc01388581c2b79b6c1071ddaccc6c797ead

  • SSDEEP

    3072:TFBsNbXv5HBh21XDiaw57rjrN/6+oXO56hKpi9poF5aY6+oocpGHHQnNJuIb:ofpBA6xrjrNy+Eu6QnFw5+0pU8b

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      15e9fb4558b3010bcccafe2819df8ed048570ab949367b93f1c0f04efb0161fbN

    • Size

      208KB

    • MD5

      dd370823942f13412a3334bf225b1840

    • SHA1

      6af426539b2b0bedee25d88ace5b2a50022b3d89

    • SHA256

      15e9fb4558b3010bcccafe2819df8ed048570ab949367b93f1c0f04efb0161fb

    • SHA512

      fd3f65902481dc1dcdb9648a6f616536cfbf401c9a202a2ea05afc55fca7c17f16c46fbfb0d61b1b3da18cf06924bc01388581c2b79b6c1071ddaccc6c797ead

    • SSDEEP

      3072:TFBsNbXv5HBh21XDiaw57rjrN/6+oXO56hKpi9poF5aY6+oocpGHHQnNJuIb:ofpBA6xrjrNy+Eu6QnFw5+0pU8b

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks