Overview

overview

10

Static

static

3

6fddd08fb6...63.exe

windows7-x64

10

6fddd08fb6...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fddd08fb6867db8ee3519a48544f90c7776bf9df60612e651997b8e35d22163

  • Size

    391KB

  • Sample

    241013-3gkc2ssgje

  • MD5

    ae8d748d66b0870dce99ffd5a227fc6a

  • SHA1

    e9f1fbb8692973135188256ebaac8bc28efb2595

  • SHA256

    6fddd08fb6867db8ee3519a48544f90c7776bf9df60612e651997b8e35d22163

  • SHA512

    4e059aede450a2997bcfa669cbdd5c8599a22797a6d8a601749d4f19d5fc9aa8e28a33bea6801e6b4b3216b4969a85d1dd7eaabd835f415b77ea44cde30bb467

  • SSDEEP

    12288:KF8myxZvT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:KF8myX79XvEhdfJkKSkU3kHyuaRB5t6f

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6fddd08fb6867db8ee3519a48544f90c7776bf9df60612e651997b8e35d22163

    • Size

      391KB

    • MD5

      ae8d748d66b0870dce99ffd5a227fc6a

    • SHA1

      e9f1fbb8692973135188256ebaac8bc28efb2595

    • SHA256

      6fddd08fb6867db8ee3519a48544f90c7776bf9df60612e651997b8e35d22163

    • SHA512

      4e059aede450a2997bcfa669cbdd5c8599a22797a6d8a601749d4f19d5fc9aa8e28a33bea6801e6b4b3216b4969a85d1dd7eaabd835f415b77ea44cde30bb467

    • SSDEEP

      12288:KF8myxZvT9XvEhdfJkKSkU3kHyuaRB5t6k0IJogZ+SZE:KF8myX79XvEhdfJkKSkU3kHyuaRB5t6f

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks