Overview

overview

10

Static

static

3

9a607d472b...2N.exe

windows7-x64

10

9a607d472b...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N

  • Size

    96KB

  • Sample

    241010-gf7lasvblk

  • MD5

    54e44fcd80fe9c17a7a5f5131e072490

  • SHA1

    a0e0dbb2099c0a616fac678cc6de78a28715c2db

  • SHA256

    9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2

  • SHA512

    05eff61813fc6dc3c539ecfef844421fe8c35deae1d62b3e41152d263dd0d9d2b8b7d0125629b3daa1c94b09fbd10387109d64b42b425bdc609d318099c72b23

  • SSDEEP

    1536:c49+i9kBkgE5Aox2XQOqyPlOtiFPDAxMxO6io5DdJ3MV1br5M78S3EzRgNfevoWr:t9z9kGgESoQXQOqalOabAxMxGo3JiSvu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2N

    • Size

      96KB

    • MD5

      54e44fcd80fe9c17a7a5f5131e072490

    • SHA1

      a0e0dbb2099c0a616fac678cc6de78a28715c2db

    • SHA256

      9a607d472b904df1ed61ed141137e61d7c006dd0050dd6a4e3224525de51ade2

    • SHA512

      05eff61813fc6dc3c539ecfef844421fe8c35deae1d62b3e41152d263dd0d9d2b8b7d0125629b3daa1c94b09fbd10387109d64b42b425bdc609d318099c72b23

    • SSDEEP

      1536:c49+i9kBkgE5Aox2XQOqyPlOtiFPDAxMxO6io5DdJ3MV1br5M78S3EzRgNfevoWr:t9z9kGgESoQXQOqalOabAxMxGo3JiSvu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks