Overview

overview

10

Static

static

3

dc78dd3fe1...a5.exe

windows7-x64

10

dc78dd3fe1...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5

  • Size

    192KB

  • Sample

    241121-lhgj4s1gjm

  • MD5

    5fca7998b33bcf9a3a62c1649587d8b9

  • SHA1

    fbf9fe14682f25c574755f407d151f85da12d1a7

  • SHA256

    dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5

  • SHA512

    149e7e340674286640cc3e255a5273b2b7eb741793025fdae5f45ce943f653bc367a8ad827d47745a5842d6a5da168fd0b068a284cb16f5840cb7a1bfccb9e75

  • SSDEEP

    3072:rkgwzjO9GdCNQIceh5nLoYDGNlib5qfpfGU4lfirgjZXmK:xYqGkNjL7GNlighD4lTjZXN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5

    • Size

      192KB

    • MD5

      5fca7998b33bcf9a3a62c1649587d8b9

    • SHA1

      fbf9fe14682f25c574755f407d151f85da12d1a7

    • SHA256

      dc78dd3fe145d62b23a61624cf216b37e142ea2b58afdb903189f98450394ea5

    • SHA512

      149e7e340674286640cc3e255a5273b2b7eb741793025fdae5f45ce943f653bc367a8ad827d47745a5842d6a5da168fd0b068a284cb16f5840cb7a1bfccb9e75

    • SSDEEP

      3072:rkgwzjO9GdCNQIceh5nLoYDGNlib5qfpfGU4lfirgjZXmK:xYqGkNjL7GNlighD4lTjZXN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks