Overview

overview

10

Static

static

3

81791ca816...60.exe

windows7-x64

10

81791ca816...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81791ca816ed82c9f0f9ae49adce507fbe012bfae46769ae274393adf2d07360.exe

  • Size

    144KB

  • Sample

    241123-1mt4bsvjdr

  • MD5

    30ef7b0c91222a27a4ae8b51ed08b6c1

  • SHA1

    8b642f137a59a336b9e876ae712738702543627a

  • SHA256

    81791ca816ed82c9f0f9ae49adce507fbe012bfae46769ae274393adf2d07360

  • SHA512

    1064bb233d7b9ebf1d46fc354c2671efd0b82d2dc748ea1c97c85b01af6429a61e9e8ec00459f83880a47361a1bc72e52310b8cabfbf86d101742529c112a8b6

  • SSDEEP

    3072:bDnMejGUJp1VEaDL3bupaCzGYJpD9r8XxrYnQg4sIp:bDnJJp1Vxf3bu4YGyZ6Yup

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      81791ca816ed82c9f0f9ae49adce507fbe012bfae46769ae274393adf2d07360.exe

    • Size

      144KB

    • MD5

      30ef7b0c91222a27a4ae8b51ed08b6c1

    • SHA1

      8b642f137a59a336b9e876ae712738702543627a

    • SHA256

      81791ca816ed82c9f0f9ae49adce507fbe012bfae46769ae274393adf2d07360

    • SHA512

      1064bb233d7b9ebf1d46fc354c2671efd0b82d2dc748ea1c97c85b01af6429a61e9e8ec00459f83880a47361a1bc72e52310b8cabfbf86d101742529c112a8b6

    • SSDEEP

      3072:bDnMejGUJp1VEaDL3bupaCzGYJpD9r8XxrYnQg4sIp:bDnJJp1Vxf3bu4YGyZ6Yup

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks