Overview

overview

10

Static

static

3

2621ddb3fa...0N.exe

windows7-x64

10

2621ddb3fa...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2621ddb3fa37435de4f774d194eeace7f822a46d0a33c7ef2edaedf937fcb100N

  • Size

    90KB

  • Sample

    241008-3rqb2stflc

  • MD5

    b44b9a813659d931b1c63ece08d1e840

  • SHA1

    a6499e20758f6c115bd0cbf1fc18dc47e18922ad

  • SHA256

    2621ddb3fa37435de4f774d194eeace7f822a46d0a33c7ef2edaedf937fcb100

  • SHA512

    d4691cbc2415372e93579fd2b835b90e5eb9019780066ef16f07794f9fc1b6f5dff108c4ff80f19ad9c552bb82a37cd0ab2b8bbfc4d8175f5815b16be993c5d8

  • SSDEEP

    1536:Ejda+R72v7zhb6HgnfgdhE2jnU3XA2fOOQ/4BrGTI5Yxj:0day7q7zp6HU6hEgnU3LU/4kT0Yxj

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2621ddb3fa37435de4f774d194eeace7f822a46d0a33c7ef2edaedf937fcb100N

    • Size

      90KB

    • MD5

      b44b9a813659d931b1c63ece08d1e840

    • SHA1

      a6499e20758f6c115bd0cbf1fc18dc47e18922ad

    • SHA256

      2621ddb3fa37435de4f774d194eeace7f822a46d0a33c7ef2edaedf937fcb100

    • SHA512

      d4691cbc2415372e93579fd2b835b90e5eb9019780066ef16f07794f9fc1b6f5dff108c4ff80f19ad9c552bb82a37cd0ab2b8bbfc4d8175f5815b16be993c5d8

    • SSDEEP

      1536:Ejda+R72v7zhb6HgnfgdhE2jnU3XA2fOOQ/4BrGTI5Yxj:0day7q7zp6HU6hEgnU3LU/4kT0Yxj

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks