Overview

overview

10

Static

static

3

d1751f8904...56.exe

windows7-x64

10

d1751f8904...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1751f8904c3de20472e36a4bea0d574eba13c536ae08cc86726b151295fc156

  • Size

    74KB

  • Sample

    241123-ehexystpbp

  • MD5

    ddab54a069eb88b3218e5e52bb8f0d5f

  • SHA1

    ac3ee78fbe1d621208f6410a42a63da055aa94e1

  • SHA256

    d1751f8904c3de20472e36a4bea0d574eba13c536ae08cc86726b151295fc156

  • SHA512

    cf01588f392509a2f78cfaf819c45080096a53693155f644c598167701e9bf2f4aebb927192352879f21128a40bcd76d6081d985cbfdf6d9fa780976a2dcba7e

  • SSDEEP

    1536:x1O2/FV4P2iWe7itnylhzp6WBVFkxcyN8vf8br1B:x1+P5Qd+9vEbr

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d1751f8904c3de20472e36a4bea0d574eba13c536ae08cc86726b151295fc156

    • Size

      74KB

    • MD5

      ddab54a069eb88b3218e5e52bb8f0d5f

    • SHA1

      ac3ee78fbe1d621208f6410a42a63da055aa94e1

    • SHA256

      d1751f8904c3de20472e36a4bea0d574eba13c536ae08cc86726b151295fc156

    • SHA512

      cf01588f392509a2f78cfaf819c45080096a53693155f644c598167701e9bf2f4aebb927192352879f21128a40bcd76d6081d985cbfdf6d9fa780976a2dcba7e

    • SSDEEP

      1536:x1O2/FV4P2iWe7itnylhzp6WBVFkxcyN8vf8br1B:x1+P5Qd+9vEbr

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks