Overview

overview

10

Static

static

3

59f14411b9...c1.exe

windows7-x64

10

59f14411b9...c1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    59f14411b92dff5a999ce648e5d07849ec8a545244b8917c83aa1acc994fc6c1

  • Size

    320KB

  • Sample

    241009-z6p32sydrg

  • MD5

    d02eca5c739ae31fdc125ea4293dc54b

  • SHA1

    052c8798baa8385211adc386f0e15d8a0823b992

  • SHA256

    59f14411b92dff5a999ce648e5d07849ec8a545244b8917c83aa1acc994fc6c1

  • SHA512

    92d2b4f40a24466e7b06435bef5699b7731a9f15de61e274d9f62095d5bc888b3d5e08f57ad09e4b25acdb1349d25e7c747dd82154da887206a4bc30e502b00b

  • SSDEEP

    6144:vz2NFuvVnGPaiV+tbFOLM77OLnFe3HCqxNRmJ4PavntPRD:v+EF1tsNePmjvtPRD

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      59f14411b92dff5a999ce648e5d07849ec8a545244b8917c83aa1acc994fc6c1

    • Size

      320KB

    • MD5

      d02eca5c739ae31fdc125ea4293dc54b

    • SHA1

      052c8798baa8385211adc386f0e15d8a0823b992

    • SHA256

      59f14411b92dff5a999ce648e5d07849ec8a545244b8917c83aa1acc994fc6c1

    • SHA512

      92d2b4f40a24466e7b06435bef5699b7731a9f15de61e274d9f62095d5bc888b3d5e08f57ad09e4b25acdb1349d25e7c747dd82154da887206a4bc30e502b00b

    • SSDEEP

      6144:vz2NFuvVnGPaiV+tbFOLM77OLnFe3HCqxNRmJ4PavntPRD:v+EF1tsNePmjvtPRD

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks