Overview

overview

10

Static

static

3

60b9cf1c8d...e4.exe

windows7-x64

10

60b9cf1c8d...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60b9cf1c8def66d20f0ee415c12e3f0ff6501241bc3f5e97f862cef517fd4de4.exe

  • Size

    207KB

  • Sample

    241121-h738matrdn

  • MD5

    243ddf4dd3880832a8b4a9f27bcc27a4

  • SHA1

    b3a6035b8ae8626e4baa14421ede98f4ce9ece5d

  • SHA256

    60b9cf1c8def66d20f0ee415c12e3f0ff6501241bc3f5e97f862cef517fd4de4

  • SHA512

    68e9bad987aaacc1ac2d67944c8bb91554377c01b6fd6fe2e70e85102fbb628833b8a5d8e24a768981692157a585562f104ba1881f6a2ddcb00a3fb164dc75cc

  • SSDEEP

    3072:G2Q/XyOT25PCQsHsbn23aUVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo2ASOvojoSR:GbXyOq5PCQl6qUVjj+VPj92d62ASOwjz

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      60b9cf1c8def66d20f0ee415c12e3f0ff6501241bc3f5e97f862cef517fd4de4.exe

    • Size

      207KB

    • MD5

      243ddf4dd3880832a8b4a9f27bcc27a4

    • SHA1

      b3a6035b8ae8626e4baa14421ede98f4ce9ece5d

    • SHA256

      60b9cf1c8def66d20f0ee415c12e3f0ff6501241bc3f5e97f862cef517fd4de4

    • SHA512

      68e9bad987aaacc1ac2d67944c8bb91554377c01b6fd6fe2e70e85102fbb628833b8a5d8e24a768981692157a585562f104ba1881f6a2ddcb00a3fb164dc75cc

    • SSDEEP

      3072:G2Q/XyOT25PCQsHsbn23aUVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo2ASOvojoSR:GbXyOq5PCQl6qUVjj+VPj92d62ASOwjz

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks