Overview

overview

10

Static

static

3

fccac2012f...2b.exe

windows7-x64

10

fccac2012f...2b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b

  • Size

    96KB

  • Sample

    241121-qrvkjssmgz

  • MD5

    d765e800d7273fd83a35a3ede1e7f807

  • SHA1

    080b824b7eea7130fcc8700bb7f4bcc91b418510

  • SHA256

    fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b

  • SHA512

    02debd04cf5c962da2af1e86bbe405a4392a6d2646cd01d830f0cd8e7774de86136cc2e5ea358c7857eb144dd97dcc8102c0cd0a5d953058f7166211b8af4d05

  • SSDEEP

    1536:YOdjqY9h2CERIZUETDC15RQQjnmpLUFiVSDWMh2tT74S7V+5pUMv84WMRw8Dkqq:YOdPhHWIZUakQQypoF76sif4Sp+7H7wd

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b

    • Size

      96KB

    • MD5

      d765e800d7273fd83a35a3ede1e7f807

    • SHA1

      080b824b7eea7130fcc8700bb7f4bcc91b418510

    • SHA256

      fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b

    • SHA512

      02debd04cf5c962da2af1e86bbe405a4392a6d2646cd01d830f0cd8e7774de86136cc2e5ea358c7857eb144dd97dcc8102c0cd0a5d953058f7166211b8af4d05

    • SSDEEP

      1536:YOdjqY9h2CERIZUETDC15RQQjnmpLUFiVSDWMh2tT74S7V+5pUMv84WMRw8Dkqq:YOdPhHWIZUakQQypoF76sif4Sp+7H7wd

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks