Overview

overview

10

Static

static

3

9bd83e3187...cN.exe

windows7-x64

10

9bd83e3187...cN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9bd83e31874f552d0c705fab675d3573388323c7d1dfcd591af82a693aa1c93cN

  • Size

    96KB

  • Sample

    241005-p9kmmatcpq

  • MD5

    3eccbfd31218c44be457b58a23ac4190

  • SHA1

    66c25ed6910f47530d34b4c2752c6143c5e41955

  • SHA256

    9bd83e31874f552d0c705fab675d3573388323c7d1dfcd591af82a693aa1c93c

  • SHA512

    3be64fb8f875360013280a92d16de7689ce13197485ea0414e3df81a6cd68dc2c817b4a3fe12cbd14f07caab81a474bd9c72676a0ca0c93918807f831cd58e6f

  • SSDEEP

    1536:dIbJXf8EfEM+bSxWQOBEjP/6OPYEPniri/Ce+LOVG8IbufOJKMPar6Ps/eh3qdu9:GpEM+fQnPBzL/DiE/43qd69jc0vf

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9bd83e31874f552d0c705fab675d3573388323c7d1dfcd591af82a693aa1c93cN

    • Size

      96KB

    • MD5

      3eccbfd31218c44be457b58a23ac4190

    • SHA1

      66c25ed6910f47530d34b4c2752c6143c5e41955

    • SHA256

      9bd83e31874f552d0c705fab675d3573388323c7d1dfcd591af82a693aa1c93c

    • SHA512

      3be64fb8f875360013280a92d16de7689ce13197485ea0414e3df81a6cd68dc2c817b4a3fe12cbd14f07caab81a474bd9c72676a0ca0c93918807f831cd58e6f

    • SSDEEP

      1536:dIbJXf8EfEM+bSxWQOBEjP/6OPYEPniri/Ce+LOVG8IbufOJKMPar6Ps/eh3qdu9:GpEM+fQnPBzL/DiE/43qd69jc0vf

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks