Overview

overview

10

Static

static

10

b58a7a9b3f...bN.exe

windows7-x64

10

b58a7a9b3f...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b58a7a9b3fd91e0aeef3c01a2161eb6976475facc111848badb649fcb432b1abN.exe

  • Size

    144KB

  • Sample

    241123-vqh8cavldj

  • MD5

    f20c13facad49c3b078fa1bb2bd7dd00

  • SHA1

    d492a5635a157f52a1e14ae8bfbe54e15277b42e

  • SHA256

    b58a7a9b3fd91e0aeef3c01a2161eb6976475facc111848badb649fcb432b1ab

  • SHA512

    e58c04ff8e16af06a089830bdb177358144cbcdd8b0b704907fa1cff484da3e7c0abafb0ffbda4b0b8d86831c9363f2c6326ee0bf7c92798f3ff6a3c2a4d5515

  • SSDEEP

    3072:pCOPdyg4nrXGcI2fj5zGYJpD9r8XxrYnQg4sIb:pbSniiZGyZ6Yub

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b58a7a9b3fd91e0aeef3c01a2161eb6976475facc111848badb649fcb432b1abN.exe

    • Size

      144KB

    • MD5

      f20c13facad49c3b078fa1bb2bd7dd00

    • SHA1

      d492a5635a157f52a1e14ae8bfbe54e15277b42e

    • SHA256

      b58a7a9b3fd91e0aeef3c01a2161eb6976475facc111848badb649fcb432b1ab

    • SHA512

      e58c04ff8e16af06a089830bdb177358144cbcdd8b0b704907fa1cff484da3e7c0abafb0ffbda4b0b8d86831c9363f2c6326ee0bf7c92798f3ff6a3c2a4d5515

    • SSDEEP

      3072:pCOPdyg4nrXGcI2fj5zGYJpD9r8XxrYnQg4sIb:pbSniiZGyZ6Yub

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks