Overview

overview

10

Static

static

3

7af4531e37...9N.exe

windows7-x64

10

7af4531e37...9N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7af4531e37b03c8bdd0b8e9e50d3a87091b927e069d9a8ceff3be1bea3814c99N

  • Size

    128KB

  • Sample

    241031-bzwegswfjf

  • MD5

    b4f26d3b0a38e3ba394d6aef4c837200

  • SHA1

    e14cd3e6e069b21b02a1e5da45c8a9da7ba510da

  • SHA256

    7af4531e37b03c8bdd0b8e9e50d3a87091b927e069d9a8ceff3be1bea3814c99

  • SHA512

    cc67cc7d36064f3e831cc278d2ad1e749c0022d3442ff0f6cd112d6d5309958953b3ef98e274e990352769a81277daea5fe7d003b7e3cd4c2d948fc56c66250d

  • SSDEEP

    3072:oCl2SaVjYcyiVS7NwvzAzGYJpD9r8XxrYnQ0:opVjlymKmLqGyZ6Yl

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7af4531e37b03c8bdd0b8e9e50d3a87091b927e069d9a8ceff3be1bea3814c99N

    • Size

      128KB

    • MD5

      b4f26d3b0a38e3ba394d6aef4c837200

    • SHA1

      e14cd3e6e069b21b02a1e5da45c8a9da7ba510da

    • SHA256

      7af4531e37b03c8bdd0b8e9e50d3a87091b927e069d9a8ceff3be1bea3814c99

    • SHA512

      cc67cc7d36064f3e831cc278d2ad1e749c0022d3442ff0f6cd112d6d5309958953b3ef98e274e990352769a81277daea5fe7d003b7e3cd4c2d948fc56c66250d

    • SSDEEP

      3072:oCl2SaVjYcyiVS7NwvzAzGYJpD9r8XxrYnQ0:opVjlymKmLqGyZ6Yl

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks