Overview

overview

10

Static

static

3

7a5afe5607...2N.exe

windows7-x64

10

7a5afe5607...2N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7a5afe56074ba615364e94bc4d64f54acdbf6d11e9f624e69bcc35e2258aaa02N

  • Size

    74KB

  • Sample

    241005-n2bt3sxbnh

  • MD5

    596d052ee73878a0c379e22126395af0

  • SHA1

    2a749b1ebfeeb206ba9e3ac1b8ae08a4b2579426

  • SHA256

    7a5afe56074ba615364e94bc4d64f54acdbf6d11e9f624e69bcc35e2258aaa02

  • SHA512

    a9e0dcfbf4d0d39923a24cb778e858a43ffd257a60fb51eabf3d3e2aa7b7a7b4e1b43e01fde3a9ffcceb07f4fd53d09e9b300d6d6eab7c247310d599f0cf71f8

  • SSDEEP

    1536:lX0aCLBCXhmifSUGcHoQvQJG+S/6uTal0jFB5:lX0aCLImP/kFQJG+SidE

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7a5afe56074ba615364e94bc4d64f54acdbf6d11e9f624e69bcc35e2258aaa02N

    • Size

      74KB

    • MD5

      596d052ee73878a0c379e22126395af0

    • SHA1

      2a749b1ebfeeb206ba9e3ac1b8ae08a4b2579426

    • SHA256

      7a5afe56074ba615364e94bc4d64f54acdbf6d11e9f624e69bcc35e2258aaa02

    • SHA512

      a9e0dcfbf4d0d39923a24cb778e858a43ffd257a60fb51eabf3d3e2aa7b7a7b4e1b43e01fde3a9ffcceb07f4fd53d09e9b300d6d6eab7c247310d599f0cf71f8

    • SSDEEP

      1536:lX0aCLBCXhmifSUGcHoQvQJG+S/6uTal0jFB5:lX0aCLImP/kFQJG+SidE

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks