Overview

overview

10

Static

static

3

37b780aafb...cN.exe

windows7-x64

10

37b780aafb...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37b780aafb581df3566e0cc3d34cfb0479cfd7bff1f06b3b09ed8f7da7daeadcN

  • Size

    74KB

  • Sample

    241015-bgbblazcnl

  • MD5

    9d1d0c2011d8e4796a4532935df66cc0

  • SHA1

    946f4ab1e5379da3c519a35c877574d9fba7d0d2

  • SHA256

    37b780aafb581df3566e0cc3d34cfb0479cfd7bff1f06b3b09ed8f7da7daeadc

  • SHA512

    058e2d5f6e042f89ca85057d9190750cdbe32cc42f213178796bf10c076c04b1ebf778f5d56b7b91de86e0334d41a93c175d192f3fcd54b0352e405ecd7efd3b

  • SSDEEP

    1536:H5GvXrKym/cZh4QLl99x2MHECoj5jyxK5wi6yNGymPe3sxoaU2uF:ZGvXrKx/QR99x2xCM5jyxK5j6yNGymP0

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      37b780aafb581df3566e0cc3d34cfb0479cfd7bff1f06b3b09ed8f7da7daeadcN

    • Size

      74KB

    • MD5

      9d1d0c2011d8e4796a4532935df66cc0

    • SHA1

      946f4ab1e5379da3c519a35c877574d9fba7d0d2

    • SHA256

      37b780aafb581df3566e0cc3d34cfb0479cfd7bff1f06b3b09ed8f7da7daeadc

    • SHA512

      058e2d5f6e042f89ca85057d9190750cdbe32cc42f213178796bf10c076c04b1ebf778f5d56b7b91de86e0334d41a93c175d192f3fcd54b0352e405ecd7efd3b

    • SSDEEP

      1536:H5GvXrKym/cZh4QLl99x2MHECoj5jyxK5wi6yNGymPe3sxoaU2uF:ZGvXrKx/QR99x2xCM5jyxK5j6yNGymP0

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks