Overview

overview

10

Static

static

3

38c6aba327...e2.exe

windows7-x64

10

38c6aba327...e2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    38c6aba327c624d4dcd670cc6a2960f0e4af18e0989c5ff5f93c29de5e040fe2

  • Size

    669KB

  • Sample

    241014-zj3qmazckk

  • MD5

    bdf347a4f3025eb010d0c7de96884872

  • SHA1

    563966fd83d562d8ee67564959749196e1b3d867

  • SHA256

    38c6aba327c624d4dcd670cc6a2960f0e4af18e0989c5ff5f93c29de5e040fe2

  • SHA512

    8a84aa5120136d42a13c614310a9f91432c8fa3169fbd142c6d671b32625ff8f10825a7180d03238587f5163d70901a2f9d85efff917b73d4459aacad82ce1dc

  • SSDEEP

    12288:KD4+eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:K8chMpQnqrdX72LbY6x46uR/qYglMi

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      38c6aba327c624d4dcd670cc6a2960f0e4af18e0989c5ff5f93c29de5e040fe2

    • Size

      669KB

    • MD5

      bdf347a4f3025eb010d0c7de96884872

    • SHA1

      563966fd83d562d8ee67564959749196e1b3d867

    • SHA256

      38c6aba327c624d4dcd670cc6a2960f0e4af18e0989c5ff5f93c29de5e040fe2

    • SHA512

      8a84aa5120136d42a13c614310a9f91432c8fa3169fbd142c6d671b32625ff8f10825a7180d03238587f5163d70901a2f9d85efff917b73d4459aacad82ce1dc

    • SSDEEP

      12288:KD4+eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:K8chMpQnqrdX72LbY6x46uR/qYglMi

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks