Overview

overview

10

Static

static

3

eca8a4e830...03.exe

windows7-x64

10

eca8a4e830...03.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    eca8a4e830bce373439766cd7ced5eabe77aa24feafea4ff604aaa7690afda03

  • Size

    364KB

  • Sample

    241014-f418razenb

  • MD5

    c27ef1026ed0be43d70252b252b54bc6

  • SHA1

    3d30d2ae6d55fb941b8faf625ffdd50adf6b9a67

  • SHA256

    eca8a4e830bce373439766cd7ced5eabe77aa24feafea4ff604aaa7690afda03

  • SHA512

    a7fa78842d66f196e34d9483c8576a1715d12c54b4bf3a389bf1e029527f7274a0ec9ddab3c15fcee21d6918c6b5fedea2fd0b663d7f95abd0c27d7d935e9a67

  • SSDEEP

    6144:eOjWPeJ/nKFxUQKLV+tbFOLM77OLnFe3HCqxNRmJ4PavntPRRI:eOjHW/tsNePmjvtPRRI

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      eca8a4e830bce373439766cd7ced5eabe77aa24feafea4ff604aaa7690afda03

    • Size

      364KB

    • MD5

      c27ef1026ed0be43d70252b252b54bc6

    • SHA1

      3d30d2ae6d55fb941b8faf625ffdd50adf6b9a67

    • SHA256

      eca8a4e830bce373439766cd7ced5eabe77aa24feafea4ff604aaa7690afda03

    • SHA512

      a7fa78842d66f196e34d9483c8576a1715d12c54b4bf3a389bf1e029527f7274a0ec9ddab3c15fcee21d6918c6b5fedea2fd0b663d7f95abd0c27d7d935e9a67

    • SSDEEP

      6144:eOjWPeJ/nKFxUQKLV+tbFOLM77OLnFe3HCqxNRmJ4PavntPRRI:eOjHW/tsNePmjvtPRRI

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks