Overview

overview

10

Static

static

3

10490a2ab0...4N.exe

windows7-x64

10

10490a2ab0...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10490a2ab0324095517adcbeae59e3d8e07e6fc19b68aabbb0b6733f92dc98b4N.exe

  • Size

    384KB

  • Sample

    241123-vqv7xaykgx

  • MD5

    f59af13ff284b24fcd348e242154c270

  • SHA1

    f37e53be6523808af2605901450ae4309e09ddca

  • SHA256

    10490a2ab0324095517adcbeae59e3d8e07e6fc19b68aabbb0b6733f92dc98b4

  • SHA512

    ebcf9e95e313d2bb93a0c790463dbfde9aeea59966d7a70b59f2246ec2faac076a1f1b28719600571a95f98b4770e357e006e0e6ec7f37c784316abcc1eacf74

  • SSDEEP

    6144:ja81AiR5hC/h8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:j5m87g7/VycgE82

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      10490a2ab0324095517adcbeae59e3d8e07e6fc19b68aabbb0b6733f92dc98b4N.exe

    • Size

      384KB

    • MD5

      f59af13ff284b24fcd348e242154c270

    • SHA1

      f37e53be6523808af2605901450ae4309e09ddca

    • SHA256

      10490a2ab0324095517adcbeae59e3d8e07e6fc19b68aabbb0b6733f92dc98b4

    • SHA512

      ebcf9e95e313d2bb93a0c790463dbfde9aeea59966d7a70b59f2246ec2faac076a1f1b28719600571a95f98b4770e357e006e0e6ec7f37c784316abcc1eacf74

    • SSDEEP

      6144:ja81AiR5hC/h8SeNpgdyuH1lZfRo0V8JcgE+ezpg12:j5m87g7/VycgE82

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks