Overview

overview

10

Static

static

3

be4b8d3f02...d8.exe

windows7-x64

10

be4b8d3f02...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be4b8d3f02fd2429cf6df1c9d7148c439b6ba9c59ad6a0f1e14914ba887e08d8

  • Size

    128KB

  • Sample

    241120-dprpnayrfw

  • MD5

    e2ff3213c5dfab51a40984d04c63bea3

  • SHA1

    242c3f18d5fd691aa486ad8edd44e68d4dbc5fb8

  • SHA256

    be4b8d3f02fd2429cf6df1c9d7148c439b6ba9c59ad6a0f1e14914ba887e08d8

  • SHA512

    b9a502dac79d7141b10359c30ced94290e4d95f3953b3cf99d5386e2c7ec4a6c57393d461564b73008c85690c7257edae5c5ca84fe101e84872710f912da79bb

  • SSDEEP

    3072:XdWrvbQ8N7bWkfeA/7DxSvITW/cbFGS9n:NWLkIbWk2AzhCw9n

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      be4b8d3f02fd2429cf6df1c9d7148c439b6ba9c59ad6a0f1e14914ba887e08d8

    • Size

      128KB

    • MD5

      e2ff3213c5dfab51a40984d04c63bea3

    • SHA1

      242c3f18d5fd691aa486ad8edd44e68d4dbc5fb8

    • SHA256

      be4b8d3f02fd2429cf6df1c9d7148c439b6ba9c59ad6a0f1e14914ba887e08d8

    • SHA512

      b9a502dac79d7141b10359c30ced94290e4d95f3953b3cf99d5386e2c7ec4a6c57393d461564b73008c85690c7257edae5c5ca84fe101e84872710f912da79bb

    • SSDEEP

      3072:XdWrvbQ8N7bWkfeA/7DxSvITW/cbFGS9n:NWLkIbWk2AzhCw9n

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks