Overview

overview

10

Static

static

3

2326c341f5...eN.exe

windows7-x64

10

2326c341f5...eN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2326c341f50c8933453624ed1e38e811e04ef9ef64984e8c38daf650d24cfb3eN

  • Size

    94KB

  • Sample

    241004-py7ysavcjk

  • MD5

    f48ba55eb188b77a3cc4d814aec507a0

  • SHA1

    1bedbb988eecfc95f5dc2967d8758588345fb8ca

  • SHA256

    2326c341f50c8933453624ed1e38e811e04ef9ef64984e8c38daf650d24cfb3e

  • SHA512

    050255c51bf51c450e65d1af9b5383b45699a22251dba8d7fcc8b819ac8ea31b8f95cfb00998a738037f98f3daca8961432e5cc82d4582c0153a31ca2899e45b

  • SSDEEP

    1536:1EGxUxYAqGZnGyhHeeQFW+SpzlpcuuQ+7ZDnxzRVkeyyVr3iwcH2ogHx:1EGx+qGRdhH2WNzlp1u1Dl3kremwc/gR

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2326c341f50c8933453624ed1e38e811e04ef9ef64984e8c38daf650d24cfb3eN

    • Size

      94KB

    • MD5

      f48ba55eb188b77a3cc4d814aec507a0

    • SHA1

      1bedbb988eecfc95f5dc2967d8758588345fb8ca

    • SHA256

      2326c341f50c8933453624ed1e38e811e04ef9ef64984e8c38daf650d24cfb3e

    • SHA512

      050255c51bf51c450e65d1af9b5383b45699a22251dba8d7fcc8b819ac8ea31b8f95cfb00998a738037f98f3daca8961432e5cc82d4582c0153a31ca2899e45b

    • SSDEEP

      1536:1EGxUxYAqGZnGyhHeeQFW+SpzlpcuuQ+7ZDnxzRVkeyyVr3iwcH2ogHx:1EGx+qGRdhH2WNzlp1u1Dl3kremwc/gR

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks