Overview

overview

10

Static

static

3

0b08d13d80...7d.exe

windows7-x64

10

0b08d13d80...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b08d13d801fa1ba8e4d96b436ab15d2dd7a3110532b6d1fe8fee9f214e1717d

  • Size

    97KB

  • Sample

    241123-x8lgjaynek

  • MD5

    7a1d1bfc669eafc521a3a75a19f0858d

  • SHA1

    010c5346b0f8efc7f3908636a7fed8a1d33a16ed

  • SHA256

    0b08d13d801fa1ba8e4d96b436ab15d2dd7a3110532b6d1fe8fee9f214e1717d

  • SHA512

    9deb76975753cac911ff6e87af5027e23a6a9afa0bc980b24de4e6fe26ff669da8edc4945156e52178e4594c5faacec4ac216f507986b489a9408ed37f8ccfa7

  • SSDEEP

    3072:767Ig9dl1+/RHSpcaT9pkBOAEarAnqHJXeKa:767Ig9dwHSurOA3Anqden

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0b08d13d801fa1ba8e4d96b436ab15d2dd7a3110532b6d1fe8fee9f214e1717d

    • Size

      97KB

    • MD5

      7a1d1bfc669eafc521a3a75a19f0858d

    • SHA1

      010c5346b0f8efc7f3908636a7fed8a1d33a16ed

    • SHA256

      0b08d13d801fa1ba8e4d96b436ab15d2dd7a3110532b6d1fe8fee9f214e1717d

    • SHA512

      9deb76975753cac911ff6e87af5027e23a6a9afa0bc980b24de4e6fe26ff669da8edc4945156e52178e4594c5faacec4ac216f507986b489a9408ed37f8ccfa7

    • SSDEEP

      3072:767Ig9dl1+/RHSpcaT9pkBOAEarAnqHJXeKa:767Ig9dwHSurOA3Anqden

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks