Overview

overview

10

Static

static

3

22739036b7...5N.exe

windows7-x64

10

22739036b7...5N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    22739036b7e4360cc2d0290bd21322f446059cba778f41621b43f2ea246e5ce5N

  • Size

    93KB

  • Sample

    241012-kt178axbpk

  • MD5

    e070041f89d60fd3229d5fed3790f770

  • SHA1

    24dee8c24a0552de4a9ba6d41f4e9d723ceaf726

  • SHA256

    22739036b7e4360cc2d0290bd21322f446059cba778f41621b43f2ea246e5ce5

  • SHA512

    5529b628cbf668b96af657cb7957fd2f4bedd8f540c7291a3d941f041770f52fc882a0eb9a4b373231131ee7d0ed9bd6cdb4bec8412484c2a5c700fda18de461

  • SSDEEP

    1536:+HafcD95D1663FbtnE89lqNCiPLTijiwg58:+6ERZ0gFBNlqNCiKY58

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      22739036b7e4360cc2d0290bd21322f446059cba778f41621b43f2ea246e5ce5N

    • Size

      93KB

    • MD5

      e070041f89d60fd3229d5fed3790f770

    • SHA1

      24dee8c24a0552de4a9ba6d41f4e9d723ceaf726

    • SHA256

      22739036b7e4360cc2d0290bd21322f446059cba778f41621b43f2ea246e5ce5

    • SHA512

      5529b628cbf668b96af657cb7957fd2f4bedd8f540c7291a3d941f041770f52fc882a0eb9a4b373231131ee7d0ed9bd6cdb4bec8412484c2a5c700fda18de461

    • SSDEEP

      1536:+HafcD95D1663FbtnE89lqNCiPLTijiwg58:+6ERZ0gFBNlqNCiKY58

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks