Overview

overview

10

Static

static

3

eda2c5df4f...ad.exe

windows7-x64

10

eda2c5df4f...ad.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eda2c5df4f55046a0ea5d1fa50039cfd24bfa9e7db1a3feb771e25171abc39ad

  • Size

    93KB

  • Sample

    241123-fmch3aypay

  • MD5

    8d8bff8aab23a6f37c3a7bedb0500b2c

  • SHA1

    65eaec3ed420d491274395619f7f558a91773f88

  • SHA256

    eda2c5df4f55046a0ea5d1fa50039cfd24bfa9e7db1a3feb771e25171abc39ad

  • SHA512

    25f10cd5c8bcd90a766a1e1fd3f776107a80e4312caed22a5bde6152f436a3f6941aa25bec94f884425b0a69a2db8ace0d81a8258417d7fd5321bc63d2162fe8

  • SSDEEP

    1536:OaTLfyrLkqedz94ve+QiiEgryjCjncsRQdRkRLJzeLD9N0iQGRNQR8RyV+32rR:OiQedh4v43NyjAedSJdEN0s4WE+3K

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      eda2c5df4f55046a0ea5d1fa50039cfd24bfa9e7db1a3feb771e25171abc39ad

    • Size

      93KB

    • MD5

      8d8bff8aab23a6f37c3a7bedb0500b2c

    • SHA1

      65eaec3ed420d491274395619f7f558a91773f88

    • SHA256

      eda2c5df4f55046a0ea5d1fa50039cfd24bfa9e7db1a3feb771e25171abc39ad

    • SHA512

      25f10cd5c8bcd90a766a1e1fd3f776107a80e4312caed22a5bde6152f436a3f6941aa25bec94f884425b0a69a2db8ace0d81a8258417d7fd5321bc63d2162fe8

    • SSDEEP

      1536:OaTLfyrLkqedz94ve+QiiEgryjCjncsRQdRkRLJzeLD9N0iQGRNQR8RyV+32rR:OiQedh4v43NyjAedSJdEN0s4WE+3K

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks