Overview

overview

10

Static

static

3

8700a4cde7...ba.exe

windows7-x64

10

8700a4cde7...ba.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8700a4cde7edc56b911e02e6c88cb434a9ae1e3d945b9fb9c286fb95938b9cba.exe

  • Size

    159KB

  • Sample

    241120-fypmrs1qf1

  • MD5

    6c4018c8a43bbddbb179b24235c28c5b

  • SHA1

    e7de63f190d246a727d9bed0fb5b58e01838ea3c

  • SHA256

    8700a4cde7edc56b911e02e6c88cb434a9ae1e3d945b9fb9c286fb95938b9cba

  • SHA512

    cffd77c9a4d3aad80c60841411a29053a487eb442c90c6a5cbddd1d25392e3e86da6ef217c1d9c6bd829d1cd08121c0894d644f2a34f1c5e3c3b6e2f2a696af1

  • SSDEEP

    3072:zJb/2c8vc2Wu53XeYqCG1NDxrTxUVfpobwf1nFzwSAJB8FgBY5nd/M9dAA:tb/XYRsd6Vxp1n6xJmPM9dAA

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8700a4cde7edc56b911e02e6c88cb434a9ae1e3d945b9fb9c286fb95938b9cba.exe

    • Size

      159KB

    • MD5

      6c4018c8a43bbddbb179b24235c28c5b

    • SHA1

      e7de63f190d246a727d9bed0fb5b58e01838ea3c

    • SHA256

      8700a4cde7edc56b911e02e6c88cb434a9ae1e3d945b9fb9c286fb95938b9cba

    • SHA512

      cffd77c9a4d3aad80c60841411a29053a487eb442c90c6a5cbddd1d25392e3e86da6ef217c1d9c6bd829d1cd08121c0894d644f2a34f1c5e3c3b6e2f2a696af1

    • SSDEEP

      3072:zJb/2c8vc2Wu53XeYqCG1NDxrTxUVfpobwf1nFzwSAJB8FgBY5nd/M9dAA:tb/XYRsd6Vxp1n6xJmPM9dAA

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks