Overview

overview

10

Static

static

3

16b92da2a4...bb.exe

windows7-x64

10

16b92da2a4...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16b92da2a4799eac203381e41cca2f188180d217538c32b6ea7be91f67fb64bb.exe

  • Size

    89KB

  • Sample

    241120-ff6tbswmbp

  • MD5

    fb906e6b4ba14bcba3abd9b9051ca0c0

  • SHA1

    218942c9ad960a5f78cf376603944c3c658d884a

  • SHA256

    16b92da2a4799eac203381e41cca2f188180d217538c32b6ea7be91f67fb64bb

  • SHA512

    5e523c50e9e402bbf719e178c13dd0ed9d714498e40a3b7816cf78088bc28a512beb9842152c3776abeabeec3ab786ceb64be8fc3db30e27a49dba5a61ef7455

  • SSDEEP

    1536:sfRHuLPOL7IxBmxmz7NP9iZ6rl/atPIIRQ+R+KRFR3RzR1URJrCiuiNj5QkMMWR7:sZcPw40mFViZ6rl/xIe+jb5ZXUf2iuOM

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      16b92da2a4799eac203381e41cca2f188180d217538c32b6ea7be91f67fb64bb.exe

    • Size

      89KB

    • MD5

      fb906e6b4ba14bcba3abd9b9051ca0c0

    • SHA1

      218942c9ad960a5f78cf376603944c3c658d884a

    • SHA256

      16b92da2a4799eac203381e41cca2f188180d217538c32b6ea7be91f67fb64bb

    • SHA512

      5e523c50e9e402bbf719e178c13dd0ed9d714498e40a3b7816cf78088bc28a512beb9842152c3776abeabeec3ab786ceb64be8fc3db30e27a49dba5a61ef7455

    • SSDEEP

      1536:sfRHuLPOL7IxBmxmz7NP9iZ6rl/atPIIRQ+R+KRFR3RzR1URJrCiuiNj5QkMMWR7:sZcPw40mFViZ6rl/xIe+jb5ZXUf2iuOM

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks