Overview

overview

10

Static

static

10

dc528ac779...2e.exe

windows7-x64

10

dc528ac779...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc528ac7796cb9dd156630432049be192ca070b8f92e1b36ebda54dbbac98e2e

  • Size

    211KB

  • Sample

    241005-ec181axhpb

  • MD5

    67cfa3fd20ff3f025a98a4914737b514

  • SHA1

    033d919d9ecfb5ff02f7b2b977a5037b7d316948

  • SHA256

    dc528ac7796cb9dd156630432049be192ca070b8f92e1b36ebda54dbbac98e2e

  • SHA512

    b9fb08584628fb3410958b73348f6d34e6cc4cfa2b2ca501a351f5a291fbbffb6cb15296398d64b94b2ca521a7021092f9a63d56b165645f0fafaaf896745ba9

  • SSDEEP

    6144:bN1MyUBnXEheYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/N:bN1UBnUheYr75lTefkY660fII

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      dc528ac7796cb9dd156630432049be192ca070b8f92e1b36ebda54dbbac98e2e

    • Size

      211KB

    • MD5

      67cfa3fd20ff3f025a98a4914737b514

    • SHA1

      033d919d9ecfb5ff02f7b2b977a5037b7d316948

    • SHA256

      dc528ac7796cb9dd156630432049be192ca070b8f92e1b36ebda54dbbac98e2e

    • SHA512

      b9fb08584628fb3410958b73348f6d34e6cc4cfa2b2ca501a351f5a291fbbffb6cb15296398d64b94b2ca521a7021092f9a63d56b165645f0fafaaf896745ba9

    • SSDEEP

      6144:bN1MyUBnXEheYr75lHzpaF2e6UK+42GTQMJSZO5f7M0rx7/N:bN1UBnUheYr75lTefkY660fII

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks