Overview

overview

10

Static

static

3

b2aa2d5b8a...1N.exe

windows7-x64

10

b2aa2d5b8a...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2aa2d5b8a9f50a1ef78273db8392e61cc3b1a5b133cdcb59509c9734eb06b21N

  • Size

    74KB

  • Sample

    241012-d7cy8a1eje

  • MD5

    c0e45ac9048a385fd067d30b85f70600

  • SHA1

    0e5040b889b204f5fc9701702ee6d63a760e6c6c

  • SHA256

    b2aa2d5b8a9f50a1ef78273db8392e61cc3b1a5b133cdcb59509c9734eb06b21

  • SHA512

    59aaaebd3e306dc2b5f5c7b9ac2e3870c023de6532bf1fbf0d185b614a2c73d7eb242e60a7f4574344a52aabffc1b0b3ec881d2239cc69c833a697d9af7595ee

  • SSDEEP

    1536:ycWyX0fUBf7iRJiHmTeiF/z6ebXGdAQ3dDx8IMue:bXXdsziHmTeixzlbStD+Vue

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b2aa2d5b8a9f50a1ef78273db8392e61cc3b1a5b133cdcb59509c9734eb06b21N

    • Size

      74KB

    • MD5

      c0e45ac9048a385fd067d30b85f70600

    • SHA1

      0e5040b889b204f5fc9701702ee6d63a760e6c6c

    • SHA256

      b2aa2d5b8a9f50a1ef78273db8392e61cc3b1a5b133cdcb59509c9734eb06b21

    • SHA512

      59aaaebd3e306dc2b5f5c7b9ac2e3870c023de6532bf1fbf0d185b614a2c73d7eb242e60a7f4574344a52aabffc1b0b3ec881d2239cc69c833a697d9af7595ee

    • SSDEEP

      1536:ycWyX0fUBf7iRJiHmTeiF/z6ebXGdAQ3dDx8IMue:bXXdsziHmTeixzlbStD+Vue

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks