Overview

overview

10

Static

static

3

c4d11e9118...6e.exe

windows7-x64

10

c4d11e9118...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4d11e9118be2b72b6825e18793d2ef108d0cb3e8b0fafc4ac97d7d14ed07a6e

  • Size

    96KB

  • Sample

    241123-dw95kstjhm

  • MD5

    a4cd0faf85cf54a3ba3bb7d2dafe6ca5

  • SHA1

    1ecb33c2479d17f8fb74c411293818c09a85e0bf

  • SHA256

    c4d11e9118be2b72b6825e18793d2ef108d0cb3e8b0fafc4ac97d7d14ed07a6e

  • SHA512

    1a305bb827a87dab667b1213b1e8e0e53db5b6e370930d12240cc223e84cae7f20deb83856d821a4947d53943e35c9458fedeb06e46b3b5337223c527314923a

  • SSDEEP

    1536:QzsEPTNxw20T8+Ey/zP5vMGS5jdf5pW90y+7srOM72t674S7V+5pUMv84WMRw8DO:8sERxw2i5b5kGGV5YWgiS4Sp+7H7wWkb

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c4d11e9118be2b72b6825e18793d2ef108d0cb3e8b0fafc4ac97d7d14ed07a6e

    • Size

      96KB

    • MD5

      a4cd0faf85cf54a3ba3bb7d2dafe6ca5

    • SHA1

      1ecb33c2479d17f8fb74c411293818c09a85e0bf

    • SHA256

      c4d11e9118be2b72b6825e18793d2ef108d0cb3e8b0fafc4ac97d7d14ed07a6e

    • SHA512

      1a305bb827a87dab667b1213b1e8e0e53db5b6e370930d12240cc223e84cae7f20deb83856d821a4947d53943e35c9458fedeb06e46b3b5337223c527314923a

    • SSDEEP

      1536:QzsEPTNxw20T8+Ey/zP5vMGS5jdf5pW90y+7srOM72t674S7V+5pUMv84WMRw8DO:8sERxw2i5b5kGGV5YWgiS4Sp+7H7wWkb

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks