Overview

overview

10

Static

static

3

02f9b3304e...9f.exe

windows7-x64

10

02f9b3304e...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02f9b3304eb1d1b6c849674cc06475739a2dc5127f85b44e9748a2331674989f

  • Size

    96KB

  • Sample

    241123-xt1mxaxqbk

  • MD5

    6570fe9c1b079d31df4ef29742406b08

  • SHA1

    e7669029d963544f38af4f0c26264669608d82bb

  • SHA256

    02f9b3304eb1d1b6c849674cc06475739a2dc5127f85b44e9748a2331674989f

  • SHA512

    1267cba8965ccd16a1b941dafd338c4702fcb0680cd2c1baa3e0e6c99e82f0048efa3c6d4908b11e808b9511bba8670ed1fea886c1e8198fd6b4204dfdca319a

  • SSDEEP

    1536:EivhLHx+a3JHR/J+e+B05QYMIOpo6Ppamzsj682Pm1LmnbVVzmcHgduV9jojTIvH:1RpPO05xM/g2PxnbVdmagd69jc0vH

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      02f9b3304eb1d1b6c849674cc06475739a2dc5127f85b44e9748a2331674989f

    • Size

      96KB

    • MD5

      6570fe9c1b079d31df4ef29742406b08

    • SHA1

      e7669029d963544f38af4f0c26264669608d82bb

    • SHA256

      02f9b3304eb1d1b6c849674cc06475739a2dc5127f85b44e9748a2331674989f

    • SHA512

      1267cba8965ccd16a1b941dafd338c4702fcb0680cd2c1baa3e0e6c99e82f0048efa3c6d4908b11e808b9511bba8670ed1fea886c1e8198fd6b4204dfdca319a

    • SSDEEP

      1536:EivhLHx+a3JHR/J+e+B05QYMIOpo6Ppamzsj682Pm1LmnbVVzmcHgduV9jojTIvH:1RpPO05xM/g2PxnbVdmagd69jc0vH

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks