Overview

overview

10

Static

static

3

fe86f72c9a...eN.exe

windows7-x64

10

fe86f72c9a...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe86f72c9afd2ab0eedc31b576f40df6c126d576b29d47c1e27a864a77baab5eN

  • Size

    89KB

  • Sample

    241017-nxaffswbma

  • MD5

    2ac280c6f6b274596a52e5352e9e6510

  • SHA1

    8e8c52a82568d8c71862a075dc59bbf32074f29e

  • SHA256

    fe86f72c9afd2ab0eedc31b576f40df6c126d576b29d47c1e27a864a77baab5e

  • SHA512

    90afd2b7f4492d860040ab23b8fe4f4371d70b39bed00f5bb86ec43d9874fc3c80e1f953854a476e730b5b7705eba715c523bc7b139234719ab5dc04fe3d77e9

  • SSDEEP

    1536:Bt+Hjku4mRL7wr76mqEMWv8AnD+0uD85RQ29R+KRFR3RzR1URJrCiuiNj5QkMMWs:Bt+Au4mRL7urMWvXNuD85eMjb5ZXUf2k

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fe86f72c9afd2ab0eedc31b576f40df6c126d576b29d47c1e27a864a77baab5eN

    • Size

      89KB

    • MD5

      2ac280c6f6b274596a52e5352e9e6510

    • SHA1

      8e8c52a82568d8c71862a075dc59bbf32074f29e

    • SHA256

      fe86f72c9afd2ab0eedc31b576f40df6c126d576b29d47c1e27a864a77baab5e

    • SHA512

      90afd2b7f4492d860040ab23b8fe4f4371d70b39bed00f5bb86ec43d9874fc3c80e1f953854a476e730b5b7705eba715c523bc7b139234719ab5dc04fe3d77e9

    • SSDEEP

      1536:Bt+Hjku4mRL7wr76mqEMWv8AnD+0uD85RQ29R+KRFR3RzR1URJrCiuiNj5QkMMWs:Bt+Au4mRL7urMWvXNuD85eMjb5ZXUf2k

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks