Overview

overview

10

Static

static

3

d7ab6de613...b5.exe

windows7-x64

10

d7ab6de613...b5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d7ab6de61344eba6c7c38e72d00b245761eb548e5d04cffa8d06a71e916fe9b5

  • Size

    96KB

  • Sample

    241015-f4rz3sxbqe

  • MD5

    4faff1f491f801286272939ea9a2a5fd

  • SHA1

    50c70886f7c68e782957af06f29c3fcc5da7dfee

  • SHA256

    d7ab6de61344eba6c7c38e72d00b245761eb548e5d04cffa8d06a71e916fe9b5

  • SHA512

    740490a630d3153f1a5c277fb54679aa858d8c00fd0901706e6ac2d87bfd38facd990a82ff4358b87886bb6229e47b0d9f48a832632997e002322fcddf4523ff

  • SSDEEP

    1536:6Bi9JSzzxTv0LFbdnRKKh/95LecAIc6duV9jojTIvjrH:6BMVLFxnPdxc6d69jc0vf

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d7ab6de61344eba6c7c38e72d00b245761eb548e5d04cffa8d06a71e916fe9b5

    • Size

      96KB

    • MD5

      4faff1f491f801286272939ea9a2a5fd

    • SHA1

      50c70886f7c68e782957af06f29c3fcc5da7dfee

    • SHA256

      d7ab6de61344eba6c7c38e72d00b245761eb548e5d04cffa8d06a71e916fe9b5

    • SHA512

      740490a630d3153f1a5c277fb54679aa858d8c00fd0901706e6ac2d87bfd38facd990a82ff4358b87886bb6229e47b0d9f48a832632997e002322fcddf4523ff

    • SSDEEP

      1536:6Bi9JSzzxTv0LFbdnRKKh/95LecAIc6duV9jojTIvjrH:6BMVLFxnPdxc6d69jc0vf

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks