Overview

overview

10

Static

static

3

88fc3428f4...dN.exe

windows7-x64

10

88fc3428f4...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88fc3428f4bdbdcf521287b83709ee7df66ebf49ef3c8abada1cd4de94ac5dfdN.exe

  • Size

    74KB

  • Sample

    241123-tljsmstndm

  • MD5

    ca305bd8b7558df25511db4def9ad550

  • SHA1

    fb62529e3b03f86a08da56f659b5d93a462edb74

  • SHA256

    88fc3428f4bdbdcf521287b83709ee7df66ebf49ef3c8abada1cd4de94ac5dfd

  • SHA512

    595af6c7eac08412c13c0fa3524a25e3d4327928e8e34870d529e7cdc0de28daf6f32f0ba2e054ac380ed4355331e337196b834089e9c5b0784fae0cb7f78e9a

  • SSDEEP

    768:ruQPgpJBxrhBK9dpTIdnkrDFJc8g2YtoGlBKGrv+pTPS4knEL7R4FlHEcS/xJ1QC:iQOnKWpkrDVMYGrES4kutXx3Q6bd

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      88fc3428f4bdbdcf521287b83709ee7df66ebf49ef3c8abada1cd4de94ac5dfdN.exe

    • Size

      74KB

    • MD5

      ca305bd8b7558df25511db4def9ad550

    • SHA1

      fb62529e3b03f86a08da56f659b5d93a462edb74

    • SHA256

      88fc3428f4bdbdcf521287b83709ee7df66ebf49ef3c8abada1cd4de94ac5dfd

    • SHA512

      595af6c7eac08412c13c0fa3524a25e3d4327928e8e34870d529e7cdc0de28daf6f32f0ba2e054ac380ed4355331e337196b834089e9c5b0784fae0cb7f78e9a

    • SSDEEP

      768:ruQPgpJBxrhBK9dpTIdnkrDFJc8g2YtoGlBKGrv+pTPS4knEL7R4FlHEcS/xJ1QC:iQOnKWpkrDVMYGrES4kutXx3Q6bd

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks