Overview

overview

10

Static

static

3

419f47be97...5N.exe

windows7-x64

10

419f47be97...5N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    419f47be97476917947517ace242ebaf8729bf39f7c76e7e4673ec2967466d65N

  • Size

    97KB

  • Sample

    241010-la1b9asglb

  • MD5

    8feeecf8a88288d94b31dfad41ea0ea0

  • SHA1

    e59d3bb633f14531c839ca7aa8b7971ee5d99a5d

  • SHA256

    419f47be97476917947517ace242ebaf8729bf39f7c76e7e4673ec2967466d65

  • SHA512

    5d567afc48189056a2bae21f64b29c69171cac48a57b98da80c825c991a79bc26b8ceb59c91e979f85f91a4476ebe5e593ec4872f44e876b5bee0dcc7e00358f

  • SSDEEP

    1536:Du1J0V0fp7b9fhyispX166l+WzA5+iGvEHJ9ISevTvJXeYZ6:Di06fpX9ZP866l+WM5pQEp9oTJXeK6

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      419f47be97476917947517ace242ebaf8729bf39f7c76e7e4673ec2967466d65N

    • Size

      97KB

    • MD5

      8feeecf8a88288d94b31dfad41ea0ea0

    • SHA1

      e59d3bb633f14531c839ca7aa8b7971ee5d99a5d

    • SHA256

      419f47be97476917947517ace242ebaf8729bf39f7c76e7e4673ec2967466d65

    • SHA512

      5d567afc48189056a2bae21f64b29c69171cac48a57b98da80c825c991a79bc26b8ceb59c91e979f85f91a4476ebe5e593ec4872f44e876b5bee0dcc7e00358f

    • SSDEEP

      1536:Du1J0V0fp7b9fhyispX166l+WzA5+iGvEHJ9ISevTvJXeYZ6:Di06fpX9ZP866l+WM5pQEp9oTJXeK6

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks