Overview

overview

10

Static

static

3

5695a2f2e3...0N.exe

windows7-x64

10

5695a2f2e3...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5695a2f2e3165f1eec3b1e060ef0b86c8acd5a1e1dbe27e11070e8ea25adc0a0N

  • Size

    96KB

  • Sample

    241010-pzphts1fpq

  • MD5

    6c57b1b9f46934d9692c9cc48de3e080

  • SHA1

    b8897e655d80f7cb863e468708f8a94bf2b710cd

  • SHA256

    5695a2f2e3165f1eec3b1e060ef0b86c8acd5a1e1dbe27e11070e8ea25adc0a0

  • SHA512

    6a56a9fd6085531da293a593b168aa1e59ad9881b197e3e66c1385ca2bce6a1bff12f0b1e48c2c3dccc279496e26b18b8876b971ef560a4dc3b485fb9728b067

  • SSDEEP

    1536:aupyCqq3qNYd4i4ijMCDKWYvR8qELF1lEWn/3uRQ+UR5R45WtqV9R2R462izMg3W:axCNSvWdKWYv8LDH/ee+UHrtG9MW3+3W

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      5695a2f2e3165f1eec3b1e060ef0b86c8acd5a1e1dbe27e11070e8ea25adc0a0N

    • Size

      96KB

    • MD5

      6c57b1b9f46934d9692c9cc48de3e080

    • SHA1

      b8897e655d80f7cb863e468708f8a94bf2b710cd

    • SHA256

      5695a2f2e3165f1eec3b1e060ef0b86c8acd5a1e1dbe27e11070e8ea25adc0a0

    • SHA512

      6a56a9fd6085531da293a593b168aa1e59ad9881b197e3e66c1385ca2bce6a1bff12f0b1e48c2c3dccc279496e26b18b8876b971ef560a4dc3b485fb9728b067

    • SSDEEP

      1536:aupyCqq3qNYd4i4ijMCDKWYvR8qELF1lEWn/3uRQ+UR5R45WtqV9R2R462izMg3W:axCNSvWdKWYv8LDH/ee+UHrtG9MW3+3W

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks