Overview

overview

10

Static

static

3

e7da26a6c0...eN.exe

windows7-x64

10

e7da26a6c0...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e7da26a6c08ecfa514539c46f455acc2ba02e64559d7b335b86e90d1cf04d61eN

  • Size

    1.9MB

  • Sample

    241101-vgg9pa1nes

  • MD5

    6db547453c89a9327b3ca2f1ed0dbf20

  • SHA1

    b09298b669611a7fd306ce494bee9846f2396151

  • SHA256

    e7da26a6c08ecfa514539c46f455acc2ba02e64559d7b335b86e90d1cf04d61e

  • SHA512

    a7abd40f2e4a276e9fac63b8dc170b8ca7da3a54166be2062401769e52b82192fc2fcbeb9002bc4b5bfd00ad1573cdcde2e3939acd330447ff7c8c3f0ef01a1f

  • SSDEEP

    24576:Xzzm0BmmvFimm0MTP7hm0BmmvFimm0JD+m0BmmvFimm0MTP7hm0BmmvFimm0G:X3iLioqiLiz

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e7da26a6c08ecfa514539c46f455acc2ba02e64559d7b335b86e90d1cf04d61eN

    • Size

      1.9MB

    • MD5

      6db547453c89a9327b3ca2f1ed0dbf20

    • SHA1

      b09298b669611a7fd306ce494bee9846f2396151

    • SHA256

      e7da26a6c08ecfa514539c46f455acc2ba02e64559d7b335b86e90d1cf04d61e

    • SHA512

      a7abd40f2e4a276e9fac63b8dc170b8ca7da3a54166be2062401769e52b82192fc2fcbeb9002bc4b5bfd00ad1573cdcde2e3939acd330447ff7c8c3f0ef01a1f

    • SSDEEP

      24576:Xzzm0BmmvFimm0MTP7hm0BmmvFimm0JD+m0BmmvFimm0MTP7hm0BmmvFimm0G:X3iLioqiLiz

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks