Overview

overview

10

Static

static

3

27d5f88830...68.exe

windows7-x64

10

27d5f88830...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27d5f88830bd5c997dd82d62b4e01027d114ede09ff9267a917939444afa4b68

  • Size

    74KB

  • Sample

    241014-ynjymsxcqk

  • MD5

    2d14bad93d7d904ef0c6ec33ca66a299

  • SHA1

    7ae176830a6fcbac9062b99f69a1477603eb8333

  • SHA256

    27d5f88830bd5c997dd82d62b4e01027d114ede09ff9267a917939444afa4b68

  • SHA512

    4f74db857042f0ab3d9b73899595384d559b28a47ab70cc0b94c63bfb022b1850264c022b524691de1f42dd50db14836c134443f30e4219304c04de5572b19f4

  • SSDEEP

    1536:NFb3/miXmPZHg7jYxa9cW3sicnW0V2mYLjWz1fAzL0DLKp:NFrKP5g7jr33sif0V2TjWqeKp

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      27d5f88830bd5c997dd82d62b4e01027d114ede09ff9267a917939444afa4b68

    • Size

      74KB

    • MD5

      2d14bad93d7d904ef0c6ec33ca66a299

    • SHA1

      7ae176830a6fcbac9062b99f69a1477603eb8333

    • SHA256

      27d5f88830bd5c997dd82d62b4e01027d114ede09ff9267a917939444afa4b68

    • SHA512

      4f74db857042f0ab3d9b73899595384d559b28a47ab70cc0b94c63bfb022b1850264c022b524691de1f42dd50db14836c134443f30e4219304c04de5572b19f4

    • SSDEEP

      1536:NFb3/miXmPZHg7jYxa9cW3sicnW0V2mYLjWz1fAzL0DLKp:NFrKP5g7jr33sif0V2TjWqeKp

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks