Overview

overview

10

Static

static

3

cfd4fe8a20...78.exe

windows7-x64

10

cfd4fe8a20...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfd4fe8a20cc599430d39b6759f403dcd044a5d36bb1a2d12944762392832f78

  • Size

    370KB

  • Sample

    241013-dxw94swhqc

  • MD5

    cb35b40d026b209c8fdafce974ca2eaa

  • SHA1

    0ba2dbe03e2a41403582b908d8f00f8db5a7be48

  • SHA256

    cfd4fe8a20cc599430d39b6759f403dcd044a5d36bb1a2d12944762392832f78

  • SHA512

    1cfd0c54ab1fe54056029f3e1e0cccb8d3f064190921b39ba25b6c092b8a23ef2eda1172def931227ef2698df5841e01c742d12db51c86e0d77794a49f4519c0

  • SSDEEP

    6144:721nxgtO2AdTrXCUYQmx147VveiLDG/dBn:7Gxf9rXD7lVDcdBn

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      cfd4fe8a20cc599430d39b6759f403dcd044a5d36bb1a2d12944762392832f78

    • Size

      370KB

    • MD5

      cb35b40d026b209c8fdafce974ca2eaa

    • SHA1

      0ba2dbe03e2a41403582b908d8f00f8db5a7be48

    • SHA256

      cfd4fe8a20cc599430d39b6759f403dcd044a5d36bb1a2d12944762392832f78

    • SHA512

      1cfd0c54ab1fe54056029f3e1e0cccb8d3f064190921b39ba25b6c092b8a23ef2eda1172def931227ef2698df5841e01c742d12db51c86e0d77794a49f4519c0

    • SSDEEP

      6144:721nxgtO2AdTrXCUYQmx147VveiLDG/dBn:7Gxf9rXD7lVDcdBn

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks