Overview

overview

10

Static

static

10

52843fdcc2...fN.exe

windows7-x64

10

52843fdcc2...fN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    52843fdcc2383d8aa6a98918a9ed8b1eeb14256eba3971bfa39ba1a69ce23a9fN

  • Size

    192KB

  • Sample

    241013-lpedbszdnf

  • MD5

    6ca15f8c59ace37decd231a38abd9f90

  • SHA1

    631ddd2c58074c407b2b3a3e57cb6f967f24b0f1

  • SHA256

    52843fdcc2383d8aa6a98918a9ed8b1eeb14256eba3971bfa39ba1a69ce23a9f

  • SHA512

    39b175d2e0663d024b1e54da26e6c8e9ec6e761527a928b6a997db053a470488b674e373122538e1f2af71c25f5051d9ad4591aa4834f3bf4374a473f394f9d5

  • SSDEEP

    3072:mey2nPu8rD0MuaEK5eRP2qOQpq3HNr5GnV54c4NthaeKU3d5vEiLqsC6vxfdwtP4:mey2nP1gLaEKMRuqO+uNk54t3haeTFLp

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      52843fdcc2383d8aa6a98918a9ed8b1eeb14256eba3971bfa39ba1a69ce23a9fN

    • Size

      192KB

    • MD5

      6ca15f8c59ace37decd231a38abd9f90

    • SHA1

      631ddd2c58074c407b2b3a3e57cb6f967f24b0f1

    • SHA256

      52843fdcc2383d8aa6a98918a9ed8b1eeb14256eba3971bfa39ba1a69ce23a9f

    • SHA512

      39b175d2e0663d024b1e54da26e6c8e9ec6e761527a928b6a997db053a470488b674e373122538e1f2af71c25f5051d9ad4591aa4834f3bf4374a473f394f9d5

    • SSDEEP

      3072:mey2nPu8rD0MuaEK5eRP2qOQpq3HNr5GnV54c4NthaeKU3d5vEiLqsC6vxfdwtP4:mey2nP1gLaEKMRuqO+uNk54t3haeTFLp

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks