Overview

overview

10

Static

static

3

47630f87a0...6b.exe

windows7-x64

10

47630f87a0...6b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47630f87a0e4aeaa15494e7829cb336af26515a97b17916d4952752a49f1e36b.exe

  • Size

    164KB

  • Sample

    241120-dvf54szhjj

  • MD5

    f60397965b1ccc9707511cd77defab33

  • SHA1

    7ef7b3c498ccb970117996614f14f7b4176fefd5

  • SHA256

    47630f87a0e4aeaa15494e7829cb336af26515a97b17916d4952752a49f1e36b

  • SHA512

    23c99b36bf79f469b3b43146a0833f208cf06e4a4403da7ba005a946595da68442fc026523ffc26436c8702d80bea1989040ec28d675d5626ab809a25e8230ef

  • SSDEEP

    3072:WlMZ/xmDr42y3xyW+J5tm908uFafmHURHAVgnvedh6DRyUr:Xa3A3xX+J58908uF8YU8gnve7GR9

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      47630f87a0e4aeaa15494e7829cb336af26515a97b17916d4952752a49f1e36b.exe

    • Size

      164KB

    • MD5

      f60397965b1ccc9707511cd77defab33

    • SHA1

      7ef7b3c498ccb970117996614f14f7b4176fefd5

    • SHA256

      47630f87a0e4aeaa15494e7829cb336af26515a97b17916d4952752a49f1e36b

    • SHA512

      23c99b36bf79f469b3b43146a0833f208cf06e4a4403da7ba005a946595da68442fc026523ffc26436c8702d80bea1989040ec28d675d5626ab809a25e8230ef

    • SSDEEP

      3072:WlMZ/xmDr42y3xyW+J5tm908uFafmHURHAVgnvedh6DRyUr:Xa3A3xX+J58908uF8YU8gnve7GR9

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks