berbew | d35c0ac69b1e81739d4a53531c44296e30736e1ea38e40867b62f4300e5e587a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d35c0ac69b1e81739d4a53531c44296e30736e1ea38e40867b62f4300e5e587aN
Size

59KB
Sample

241018-aaz6psxbmj
MD5

c4be91bd9aa08ec163262e3dc28ae390
SHA1

2891b08f62701d2b3db4ffeeac8d162c3633c029
SHA256

d35c0ac69b1e81739d4a53531c44296e30736e1ea38e40867b62f4300e5e587a
SHA512

a39a3b56103fb953e777a0cbc830f2587e317f3c48e7dd09fd9804d2af48b11edceb4b8f4cbc3a5f594a4e4104dc723c39a656c569dae124f0d6ee29bedeadc8
SSDEEP

1536:rKBF8TN3xznrkwxPinQ80uCfbH6DNCyVs:rKBeZ3Zr7xepCTDes

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Targets

- Target
  
  d35c0ac69b1e81739d4a53531c44296e30736e1ea38e40867b62f4300e5e587aN
- Size
  
  59KB
- MD5
  
  c4be91bd9aa08ec163262e3dc28ae390
- SHA1
  
  2891b08f62701d2b3db4ffeeac8d162c3633c029
- SHA256
  
  d35c0ac69b1e81739d4a53531c44296e30736e1ea38e40867b62f4300e5e587a
- SHA512
  
  a39a3b56103fb953e777a0cbc830f2587e317f3c48e7dd09fd9804d2af48b11edceb4b8f4cbc3a5f594a4e4104dc723c39a656c569dae124f0d6ee29bedeadc8
- SSDEEP
  
  1536:rKBF8TN3xznrkwxPinQ80uCfbH6DNCyVs:rKBeZ3Zr7xepCTDes
Score

10^/10

berbew backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbackdoordiscoverypersistence

behavioral2

berbewbackdoordiscoverypersistence