Overview

overview

10

Static

static

3

cecc535547...7b.exe

windows7-x64

10

cecc535547...7b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cecc53554728223ec93221bd90a27c72d768f4f6edfca24294ac42989b09ca7b

  • Size

    93KB

  • Sample

    241123-edlvpstnfj

  • MD5

    ce22144f92af71f8c487e6a5fb6a6eed

  • SHA1

    dec5ec7c57d5dd7f64c6b6461d8580ce433e2a62

  • SHA256

    cecc53554728223ec93221bd90a27c72d768f4f6edfca24294ac42989b09ca7b

  • SHA512

    14699699f21f3c5b0663f17a74b2b7ef7abf821f6fc7f048da61e9efd588e5618d0b0b4cfd92107d3834957c649337cac64b156c445e54ca74069a90a5733adb

  • SSDEEP

    1536:u5E7AGB6omjcx2ig2GrzuCNf8O7GnL3qYYqcsRQtRkRLJzeLD9N0iQGRNQR8RyVP:QEbmjAgtrzucDCL3JetSJdEN0s4WE+3e

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      cecc53554728223ec93221bd90a27c72d768f4f6edfca24294ac42989b09ca7b

    • Size

      93KB

    • MD5

      ce22144f92af71f8c487e6a5fb6a6eed

    • SHA1

      dec5ec7c57d5dd7f64c6b6461d8580ce433e2a62

    • SHA256

      cecc53554728223ec93221bd90a27c72d768f4f6edfca24294ac42989b09ca7b

    • SHA512

      14699699f21f3c5b0663f17a74b2b7ef7abf821f6fc7f048da61e9efd588e5618d0b0b4cfd92107d3834957c649337cac64b156c445e54ca74069a90a5733adb

    • SSDEEP

      1536:u5E7AGB6omjcx2ig2GrzuCNf8O7GnL3qYYqcsRQtRkRLJzeLD9N0iQGRNQR8RyVP:QEbmjAgtrzucDCL3JetSJdEN0s4WE+3e

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks