Overview

overview

10

Static

static

10

940e27cae5...2N.exe

windows7-x64

10

940e27cae5...2N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    940e27cae5e494c558943b45cc5d6874c50635cbbe552ec757285fd6675e32c2N

  • Size

    161KB

  • Sample

    241014-hpc9gswcpl

  • MD5

    ad4886ae655e4677213fd5c3647a8860

  • SHA1

    72e1a4237d697fe1e2cc8b5a9dc09195781160fb

  • SHA256

    940e27cae5e494c558943b45cc5d6874c50635cbbe552ec757285fd6675e32c2

  • SHA512

    a0b36a0e9336a3f7e18a8791bbf8f4ce0dc55a6e4f4fdcbeacc3cdcb5867c6b59d82e9bd03aa8edda4a8228c912e0d4f08c8613acbc56a555422090fb23411d5

  • SSDEEP

    3072:JuIQ6ZVO8XPB46GKtw5hY3jkxVwtCJXeex7rrIRZK8K8/kvN:MIlZr46HC5akxVwtmeetrIyRN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      940e27cae5e494c558943b45cc5d6874c50635cbbe552ec757285fd6675e32c2N

    • Size

      161KB

    • MD5

      ad4886ae655e4677213fd5c3647a8860

    • SHA1

      72e1a4237d697fe1e2cc8b5a9dc09195781160fb

    • SHA256

      940e27cae5e494c558943b45cc5d6874c50635cbbe552ec757285fd6675e32c2

    • SHA512

      a0b36a0e9336a3f7e18a8791bbf8f4ce0dc55a6e4f4fdcbeacc3cdcb5867c6b59d82e9bd03aa8edda4a8228c912e0d4f08c8613acbc56a555422090fb23411d5

    • SSDEEP

      3072:JuIQ6ZVO8XPB46GKtw5hY3jkxVwtCJXeex7rrIRZK8K8/kvN:MIlZr46HC5akxVwtmeetrIyRN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks