Overview

overview

10

Static

static

10

ec0df0543e...7a.exe

windows7-x64

10

ec0df0543e...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec0df0543ead3980cf680370549f2c1efec1f68509585e83a17b3225d702907a.exe

  • Size

    144KB

  • Sample

    241123-na5m3stmf1

  • MD5

    dd32828f6c0b8adb8a80c505201af57b

  • SHA1

    bb5d1f0c340fca5c264467307bd3b070071346fb

  • SHA256

    ec0df0543ead3980cf680370549f2c1efec1f68509585e83a17b3225d702907a

  • SHA512

    b61db629253748f17ad991fd35c9390093406ab8965d679dcbd12d00a6d7126d605d7ee6c1df45eb83ca07b5bb077caf06aff2fef866a3fd83915fb9e8953c9d

  • SSDEEP

    3072:pCOPdyg4nrXGcI2fj5zGYJpD9r8XxrYnQg4sIh:pbSniiZGyZ6Yuh

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      ec0df0543ead3980cf680370549f2c1efec1f68509585e83a17b3225d702907a.exe

    • Size

      144KB

    • MD5

      dd32828f6c0b8adb8a80c505201af57b

    • SHA1

      bb5d1f0c340fca5c264467307bd3b070071346fb

    • SHA256

      ec0df0543ead3980cf680370549f2c1efec1f68509585e83a17b3225d702907a

    • SHA512

      b61db629253748f17ad991fd35c9390093406ab8965d679dcbd12d00a6d7126d605d7ee6c1df45eb83ca07b5bb077caf06aff2fef866a3fd83915fb9e8953c9d

    • SSDEEP

      3072:pCOPdyg4nrXGcI2fj5zGYJpD9r8XxrYnQg4sIh:pbSniiZGyZ6Yuh

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks