Overview

overview

10

Static

static

3

6e1ed78943...4N.exe

windows7-x64

10

6e1ed78943...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e1ed789431c5e8b4ed2fb0726d885a467c71e1c1d1a74a1f721d32711aa1494N.exe

  • Size

    89KB

  • Sample

    241119-vc7nsayhjm

  • MD5

    43ebc759a107a86441dd5873b248f580

  • SHA1

    777bce71ea25b38dc702fad305c195830e1099dd

  • SHA256

    6e1ed789431c5e8b4ed2fb0726d885a467c71e1c1d1a74a1f721d32711aa1494

  • SHA512

    43744c310a8da0f8ef8292b9dd8770f9393a6dad64202b390a45f8c17bb7ac28907bb3ede2afa8b22126b630f687e035fd97038b1c6a413d44294d7626989410

  • SSDEEP

    1536:yKN2IbWPeditqt+V9qhaFaIkihnYO4qYlx/7/RQnR+KRFR3RzR1URJrCiuiNj5Ql:yJuitqt+P0axkiiHJlNrenjb5ZXUf2iU

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6e1ed789431c5e8b4ed2fb0726d885a467c71e1c1d1a74a1f721d32711aa1494N.exe

    • Size

      89KB

    • MD5

      43ebc759a107a86441dd5873b248f580

    • SHA1

      777bce71ea25b38dc702fad305c195830e1099dd

    • SHA256

      6e1ed789431c5e8b4ed2fb0726d885a467c71e1c1d1a74a1f721d32711aa1494

    • SHA512

      43744c310a8da0f8ef8292b9dd8770f9393a6dad64202b390a45f8c17bb7ac28907bb3ede2afa8b22126b630f687e035fd97038b1c6a413d44294d7626989410

    • SSDEEP

      1536:yKN2IbWPeditqt+V9qhaFaIkihnYO4qYlx/7/RQnR+KRFR3RzR1URJrCiuiNj5Ql:yJuitqt+P0axkiiHJlNrenjb5ZXUf2iU

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks