Overview

overview

10

Static

static

3

77c2f85de3...cN.exe

windows7-x64

10

77c2f85de3...cN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    77c2f85de34e430ef59990649c160fb1e1e956a1413371f07e28cb64e01a0b1cN

  • Size

    448KB

  • Sample

    241009-hwbn8swbjf

  • MD5

    f809b5fa89daaa99a4909b5425ee4760

  • SHA1

    ac2f32f13e4190308650ec2787a87e915dd3c1ab

  • SHA256

    77c2f85de34e430ef59990649c160fb1e1e956a1413371f07e28cb64e01a0b1c

  • SHA512

    b0da2a69d0d542d685987217bb5e2491dc034bb9e36e2628c1faa929aaf0d7169f6f4db394d2f7d1bf68dc77ed78bc16cf4503cdbc5aa6e59b907b94ee5fb884

  • SSDEEP

    6144:8m+2e1/FM6234lKm3mo8Yvi4KsLTFM6234lKm3r8SeNpgdyuH1lZfRo0VM:hOlFB24lwR45FB24lJ87g7/VM

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      77c2f85de34e430ef59990649c160fb1e1e956a1413371f07e28cb64e01a0b1cN

    • Size

      448KB

    • MD5

      f809b5fa89daaa99a4909b5425ee4760

    • SHA1

      ac2f32f13e4190308650ec2787a87e915dd3c1ab

    • SHA256

      77c2f85de34e430ef59990649c160fb1e1e956a1413371f07e28cb64e01a0b1c

    • SHA512

      b0da2a69d0d542d685987217bb5e2491dc034bb9e36e2628c1faa929aaf0d7169f6f4db394d2f7d1bf68dc77ed78bc16cf4503cdbc5aa6e59b907b94ee5fb884

    • SSDEEP

      6144:8m+2e1/FM6234lKm3mo8Yvi4KsLTFM6234lKm3r8SeNpgdyuH1lZfRo0VM:hOlFB24lwR45FB24lJ87g7/VM

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks