Overview

overview

10

Static

static

3

fb6157861e...97.exe

windows7-x64

10

fb6157861e...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb6157861e246418ae6e245505198f54548c2dbe8ba15010ce39013dbd92c997.exe

  • Size

    74KB

  • Sample

    241120-alqreawhlq

  • MD5

    14ca98b97d2daed2b9f413c208f5b4b4

  • SHA1

    c9d32a0b89652a97bff0c33e7b4e827012f68104

  • SHA256

    fb6157861e246418ae6e245505198f54548c2dbe8ba15010ce39013dbd92c997

  • SHA512

    38169d73e1589919ecce75002a0b1f7e2a7bdc349e264a3cb2b17801e0b7b82e7dff1f011eb97b08e3d02efba84d284926a4c14dace0d15a100e770b513fadbe

  • SSDEEP

    1536:cvFK9uJeORdIMfWE9QfJyDsDZRBUlsepZix39KP:sAuJeO/IMfW9f8ySsK+39KP

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fb6157861e246418ae6e245505198f54548c2dbe8ba15010ce39013dbd92c997.exe

    • Size

      74KB

    • MD5

      14ca98b97d2daed2b9f413c208f5b4b4

    • SHA1

      c9d32a0b89652a97bff0c33e7b4e827012f68104

    • SHA256

      fb6157861e246418ae6e245505198f54548c2dbe8ba15010ce39013dbd92c997

    • SHA512

      38169d73e1589919ecce75002a0b1f7e2a7bdc349e264a3cb2b17801e0b7b82e7dff1f011eb97b08e3d02efba84d284926a4c14dace0d15a100e770b513fadbe

    • SSDEEP

      1536:cvFK9uJeORdIMfWE9QfJyDsDZRBUlsepZix39KP:sAuJeO/IMfW9f8ySsK+39KP

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks