Overview

overview

10

Static

static

3

db0941b321...9e.exe

windows7-x64

10

db0941b321...9e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db0941b321ef3ef26e78becc08773a03243de92092b16d281d700df2cf077f9e

  • Size

    93KB

  • Sample

    241121-lda7javphj

  • MD5

    96c2283ea48e344a6dc8666af15a3574

  • SHA1

    9c865b2c06c697d4960197122a18a1826c6ad23c

  • SHA256

    db0941b321ef3ef26e78becc08773a03243de92092b16d281d700df2cf077f9e

  • SHA512

    17b585723a0766f8850d2decc0c63859e0e8e87338dc5be888d91035c34eaaa9fc89204769a86d07ca321c177b59b47ac92d3359baa9e07115d7a1230391b8a5

  • SSDEEP

    1536:/I6nDGGv2EGrc9puSm872iOtjGtWjELpsu0RrRQJ1RRs3cO57OWxXPu4n6yYPLBp:fnyq2EyBcCRjhprebE9pui6yYPaI7Df

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      db0941b321ef3ef26e78becc08773a03243de92092b16d281d700df2cf077f9e

    • Size

      93KB

    • MD5

      96c2283ea48e344a6dc8666af15a3574

    • SHA1

      9c865b2c06c697d4960197122a18a1826c6ad23c

    • SHA256

      db0941b321ef3ef26e78becc08773a03243de92092b16d281d700df2cf077f9e

    • SHA512

      17b585723a0766f8850d2decc0c63859e0e8e87338dc5be888d91035c34eaaa9fc89204769a86d07ca321c177b59b47ac92d3359baa9e07115d7a1230391b8a5

    • SSDEEP

      1536:/I6nDGGv2EGrc9puSm872iOtjGtWjELpsu0RrRQJ1RRs3cO57OWxXPu4n6yYPLBp:fnyq2EyBcCRjhprebE9pui6yYPaI7Df

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks