Overview

overview

10

Static

static

3

a5fd549f8b...84.exe

windows7-x64

10

a5fd549f8b...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a5fd549f8be6e27867ded19517a3b2aa12de1eca15fc6efd650dd1ceb1296684

  • Size

    128KB

  • Sample

    241121-enyx1symdv

  • MD5

    9aac1ec093b5dd96f62ae45eae57b4ee

  • SHA1

    3fa6c1b90182a8adff396f915a2113d2414fad08

  • SHA256

    a5fd549f8be6e27867ded19517a3b2aa12de1eca15fc6efd650dd1ceb1296684

  • SHA512

    ca28506ed5d83bfb4ecfe301e42b19cef13d84268624caac4de7acd49535284cce3103b1be366aab5b6772e3dcefa471eb27b23d89bf544618a999e178263b37

  • SSDEEP

    3072:EkfXV17f78PgRApcTBKQK830KFo/clUr2g+08uFafmHURHAVgnvedh6:TfXV17BK383OclUb+08uF8YU8gnve7

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a5fd549f8be6e27867ded19517a3b2aa12de1eca15fc6efd650dd1ceb1296684

    • Size

      128KB

    • MD5

      9aac1ec093b5dd96f62ae45eae57b4ee

    • SHA1

      3fa6c1b90182a8adff396f915a2113d2414fad08

    • SHA256

      a5fd549f8be6e27867ded19517a3b2aa12de1eca15fc6efd650dd1ceb1296684

    • SHA512

      ca28506ed5d83bfb4ecfe301e42b19cef13d84268624caac4de7acd49535284cce3103b1be366aab5b6772e3dcefa471eb27b23d89bf544618a999e178263b37

    • SSDEEP

      3072:EkfXV17f78PgRApcTBKQK830KFo/clUr2g+08uFafmHURHAVgnvedh6:TfXV17BK383OclUb+08uF8YU8gnve7

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks