Overview

overview

10

Static

static

3

32542bcc88...b5.exe

windows7-x64

10

32542bcc88...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32542bcc88499d34ed050dae38bedc0b87fa9fc20ecd1de6a8d9d878f96deeb5.exe

  • Size

    74KB

  • Sample

    241123-tq9jvstpaj

  • MD5

    f6907923e830cbd00ac05c7fb7ddc512

  • SHA1

    7b9be524fd50ea85081d35b2942ae4ab61a620f0

  • SHA256

    32542bcc88499d34ed050dae38bedc0b87fa9fc20ecd1de6a8d9d878f96deeb5

  • SHA512

    bc2b5336cea3ee72d88e38d0bd49a049286ff7e88eee8c115e55e7d96b8e704f4d098dade26ed5be85f9eae42b262dc12f334ed20968b758e4ae6d93026c1b62

  • SSDEEP

    1536:kSTcS1fx6Xp35GcVpQRdVy720XZsnxmZ2h1udh5acMR:FrGfdH72UZXcOh+R

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      32542bcc88499d34ed050dae38bedc0b87fa9fc20ecd1de6a8d9d878f96deeb5.exe

    • Size

      74KB

    • MD5

      f6907923e830cbd00ac05c7fb7ddc512

    • SHA1

      7b9be524fd50ea85081d35b2942ae4ab61a620f0

    • SHA256

      32542bcc88499d34ed050dae38bedc0b87fa9fc20ecd1de6a8d9d878f96deeb5

    • SHA512

      bc2b5336cea3ee72d88e38d0bd49a049286ff7e88eee8c115e55e7d96b8e704f4d098dade26ed5be85f9eae42b262dc12f334ed20968b758e4ae6d93026c1b62

    • SSDEEP

      1536:kSTcS1fx6Xp35GcVpQRdVy720XZsnxmZ2h1udh5acMR:FrGfdH72UZXcOh+R

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks