Overview

overview

10

Static

static

3

e61338a0a9...61.exe

windows7-x64

10

e61338a0a9...61.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e61338a0a9db838d2767f97551b371e318f8466a0be4d6c72d23847540598961

  • Size

    1.5MB

  • Sample

    241123-fb3wwavlhq

  • MD5

    8c0bfeca53cf047bc34e62a3b97bf9ac

  • SHA1

    1eb6ecb6bf656da9c85d6eb242ef2d4ae42b8a24

  • SHA256

    e61338a0a9db838d2767f97551b371e318f8466a0be4d6c72d23847540598961

  • SHA512

    cbfb63fd8d5107b5fb8696d7668ed0036b3d4bd0915aad855b6249caa1877fbaf047fbaad9763e1b065ac2fb56db63d1611a177fb8f598950a26d9f669b27d12

  • SSDEEP

    24576:RGHxT4Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWtec+fwv4cXl:1bazR0vKLXZnec+Yv4cXcy6l6mFndw2m

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e61338a0a9db838d2767f97551b371e318f8466a0be4d6c72d23847540598961

    • Size

      1.5MB

    • MD5

      8c0bfeca53cf047bc34e62a3b97bf9ac

    • SHA1

      1eb6ecb6bf656da9c85d6eb242ef2d4ae42b8a24

    • SHA256

      e61338a0a9db838d2767f97551b371e318f8466a0be4d6c72d23847540598961

    • SHA512

      cbfb63fd8d5107b5fb8696d7668ed0036b3d4bd0915aad855b6249caa1877fbaf047fbaad9763e1b065ac2fb56db63d1611a177fb8f598950a26d9f669b27d12

    • SSDEEP

      24576:RGHxT4Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWtec+fwv4cXl:1bazR0vKLXZnec+Yv4cXcy6l6mFndw2m

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks