Overview

overview

10

Static

static

3

a0bd959108...2d.exe

windows7-x64

10

a0bd959108...2d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0bd95910840e0798bd516958cbbcd09d3137feb2e764a3fc56e39f9c4bbdf2d

  • Size

    80KB

  • Sample

    241123-b8bfnsvlfv

  • MD5

    cf76cfabe9b522c2a721d034435fa7bb

  • SHA1

    3fc8fc4a228ff9ca45b58fc2d2f1de4f41181a39

  • SHA256

    a0bd95910840e0798bd516958cbbcd09d3137feb2e764a3fc56e39f9c4bbdf2d

  • SHA512

    f49f157e282ce8613c3b7929ddc5a195f3da20675cb500e18eac55dbe4c4cf1b5192bacb49e1feae7b75037fb4773e01245bbe24ca4db5eb1e8a67e3914b5700

  • SSDEEP

    1536:2aPBxh8Fh+wQwD5u6ge5KW6ZivLuOATSvjDV6FeJuqnhCN:2aP58Fh+wd5u6/5B7vLXV6FeJLCN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a0bd95910840e0798bd516958cbbcd09d3137feb2e764a3fc56e39f9c4bbdf2d

    • Size

      80KB

    • MD5

      cf76cfabe9b522c2a721d034435fa7bb

    • SHA1

      3fc8fc4a228ff9ca45b58fc2d2f1de4f41181a39

    • SHA256

      a0bd95910840e0798bd516958cbbcd09d3137feb2e764a3fc56e39f9c4bbdf2d

    • SHA512

      f49f157e282ce8613c3b7929ddc5a195f3da20675cb500e18eac55dbe4c4cf1b5192bacb49e1feae7b75037fb4773e01245bbe24ca4db5eb1e8a67e3914b5700

    • SSDEEP

      1536:2aPBxh8Fh+wQwD5u6ge5KW6ZivLuOATSvjDV6FeJuqnhCN:2aP58Fh+wd5u6/5B7vLXV6FeJLCN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks