Overview

overview

10

Static

static

3

25c4fb65af...aN.exe

windows7-x64

10

25c4fb65af...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25c4fb65af0e19cf1af7942e986c1982a532238d515649dffb163dae427fb4faN.exe

  • Size

    264KB

  • Sample

    241120-f87w4asgmp

  • MD5

    fad760ed12a7105badf32d8a2ae7a5f0

  • SHA1

    39f751b520a332bb44d707624a616c2d1c4e75ae

  • SHA256

    25c4fb65af0e19cf1af7942e986c1982a532238d515649dffb163dae427fb4fa

  • SHA512

    f00e41565936d813d326f6cc0edff9cfb7038880c2e6786c20c5c1bff5ed25a3ed7207a1c40659fe8ec646617a76e783007736ace02af7ae51b759c9cda5b84d

  • SSDEEP

    6144:Xn1SrbDSjKyHOtvFpui6yYPaIGckVx3cGHGcXW3w4LOypui6yYPaIGckv:Xn1SrbDlIOpV6yYP0K3vFpV6yYPo

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      25c4fb65af0e19cf1af7942e986c1982a532238d515649dffb163dae427fb4faN.exe

    • Size

      264KB

    • MD5

      fad760ed12a7105badf32d8a2ae7a5f0

    • SHA1

      39f751b520a332bb44d707624a616c2d1c4e75ae

    • SHA256

      25c4fb65af0e19cf1af7942e986c1982a532238d515649dffb163dae427fb4fa

    • SHA512

      f00e41565936d813d326f6cc0edff9cfb7038880c2e6786c20c5c1bff5ed25a3ed7207a1c40659fe8ec646617a76e783007736ace02af7ae51b759c9cda5b84d

    • SSDEEP

      6144:Xn1SrbDSjKyHOtvFpui6yYPaIGckVx3cGHGcXW3w4LOypui6yYPaIGckv:Xn1SrbDlIOpV6yYP0K3vFpV6yYPo

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks