Overview

overview

10

Static

static

3

b9ead5d8fd...42.exe

windows7-x64

10

b9ead5d8fd...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9ead5d8fdf57a0a5bb6e173adc480c7ce8e3b4e26cf26e7083f06287b07d542

  • Size

    96KB

  • Sample

    241123-def56swphy

  • MD5

    66305ce8aaacc69b3582458763968cd8

  • SHA1

    470239456d7b269c99ff9de8b0eb8678282de65f

  • SHA256

    b9ead5d8fdf57a0a5bb6e173adc480c7ce8e3b4e26cf26e7083f06287b07d542

  • SHA512

    c1fcf88b03a67f391907401898d0797c745cfeb8f87c8b38059c15d9af7e3e577a425ab10a1b5062178a2b251b391dec572a76779cf6e93f5aa8b6c0e9afab9f

  • SSDEEP

    1536:b06VOgjMYqU6rXoIzlD2vcnVm0mz8nNVMx7WEZp0E5FFfUN1Avhw6JCMd:A0OCyUilBmhIVMxN35FFfUrQlMW

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b9ead5d8fdf57a0a5bb6e173adc480c7ce8e3b4e26cf26e7083f06287b07d542

    • Size

      96KB

    • MD5

      66305ce8aaacc69b3582458763968cd8

    • SHA1

      470239456d7b269c99ff9de8b0eb8678282de65f

    • SHA256

      b9ead5d8fdf57a0a5bb6e173adc480c7ce8e3b4e26cf26e7083f06287b07d542

    • SHA512

      c1fcf88b03a67f391907401898d0797c745cfeb8f87c8b38059c15d9af7e3e577a425ab10a1b5062178a2b251b391dec572a76779cf6e93f5aa8b6c0e9afab9f

    • SSDEEP

      1536:b06VOgjMYqU6rXoIzlD2vcnVm0mz8nNVMx7WEZp0E5FFfUN1Avhw6JCMd:A0OCyUilBmhIVMxN35FFfUrQlMW

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks