Overview

overview

10

Static

static

3

3dad180daa...ab.exe

windows7-x64

10

3dad180daa...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3dad180daa2f3695a56809859761a295da0589b30c30abde41acd2ce404909ab

  • Size

    74KB

  • Sample

    241123-1dz8zsxnfz

  • MD5

    a9e40189ffc6bee18e8ff0646e613ac7

  • SHA1

    7c9e7bb021dd4d7564fd3f665449320aa436a39e

  • SHA256

    3dad180daa2f3695a56809859761a295da0589b30c30abde41acd2ce404909ab

  • SHA512

    8f36350d7b749e39aaba58b0c34ca8ed4dc700e840e16eb3ba39805a9ac24dba8bd21ce8b0ac24e649a9122604f967e1b3cb5143dcd2fbddda20de0d0e778885

  • SSDEEP

    1536:IARkLHw+8eQtAUtYfrZ7r8UDx7Zz5HpUsWr+IvbRc:TRVtAr9r8yxFz5EyIvFc

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      3dad180daa2f3695a56809859761a295da0589b30c30abde41acd2ce404909ab

    • Size

      74KB

    • MD5

      a9e40189ffc6bee18e8ff0646e613ac7

    • SHA1

      7c9e7bb021dd4d7564fd3f665449320aa436a39e

    • SHA256

      3dad180daa2f3695a56809859761a295da0589b30c30abde41acd2ce404909ab

    • SHA512

      8f36350d7b749e39aaba58b0c34ca8ed4dc700e840e16eb3ba39805a9ac24dba8bd21ce8b0ac24e649a9122604f967e1b3cb5143dcd2fbddda20de0d0e778885

    • SSDEEP

      1536:IARkLHw+8eQtAUtYfrZ7r8UDx7Zz5HpUsWr+IvbRc:TRVtAr9r8yxFz5EyIvFc

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks