Overview

overview

10

Static

static

3

c408f55ee2...f7.exe

windows7-x64

10

c408f55ee2...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c408f55ee29a4b9de6fb15d05b689ea9ec539b6065f0d776d3f6345f07abcbf7

  • Size

    92KB

  • Sample

    241123-dvktastjer

  • MD5

    29bdad0a553bc0a14e85aa39fc97cc8d

  • SHA1

    449b1ccc3a55c344d71f02d537af228b473a8b36

  • SHA256

    c408f55ee29a4b9de6fb15d05b689ea9ec539b6065f0d776d3f6345f07abcbf7

  • SHA512

    cf7046b75d465dfd3d9541829a6d7dd1bcc1fc57d490bad00bfda4d1653f399f34bc2251ee631fcab6bb0f012d5230ed096980d0fb4ba6af56673c92675b416b

  • SSDEEP

    1536:okCB9kd8AjA2M3SDcGWjIHcCZc5mz8+QquozVV/y8ED3Xgq6:oFBj8xtDcGWucwNAIzVtyVgd

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c408f55ee29a4b9de6fb15d05b689ea9ec539b6065f0d776d3f6345f07abcbf7

    • Size

      92KB

    • MD5

      29bdad0a553bc0a14e85aa39fc97cc8d

    • SHA1

      449b1ccc3a55c344d71f02d537af228b473a8b36

    • SHA256

      c408f55ee29a4b9de6fb15d05b689ea9ec539b6065f0d776d3f6345f07abcbf7

    • SHA512

      cf7046b75d465dfd3d9541829a6d7dd1bcc1fc57d490bad00bfda4d1653f399f34bc2251ee631fcab6bb0f012d5230ed096980d0fb4ba6af56673c92675b416b

    • SSDEEP

      1536:okCB9kd8AjA2M3SDcGWjIHcCZc5mz8+QquozVV/y8ED3Xgq6:oFBj8xtDcGWucwNAIzVtyVgd

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks