Overview

overview

10

Static

static

3

0f4e00d3b7...45.exe

windows7-x64

10

0f4e00d3b7...45.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f4e00d3b7216fbcb95f9ecc438c3138563fc677609a169e86127eacfc809645

  • Size

    89KB

  • Sample

    241123-ydg2asspcy

  • MD5

    a51fae65a88f1f2f37b443492ef459dc

  • SHA1

    9b1d88fe6029ac0a25da6319e026a2ceaead5496

  • SHA256

    0f4e00d3b7216fbcb95f9ecc438c3138563fc677609a169e86127eacfc809645

  • SHA512

    45bdb88e1d375e22d87edffd618fb2b65153249d32f2e6321775fcf898b70c00ff9453eeec86b90901fe342029a8ece9d27ae137ad644e7a46b728fd01d86afc

  • SSDEEP

    1536:HRqYOP7hiS8AnmQA7Dan/evV5k/tqHqkCGyv1fGgXRXLvL68VG5ExcSlExkg8F:HRqYOPli3Ana7GevC23C3f7cSlakgw

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0f4e00d3b7216fbcb95f9ecc438c3138563fc677609a169e86127eacfc809645

    • Size

      89KB

    • MD5

      a51fae65a88f1f2f37b443492ef459dc

    • SHA1

      9b1d88fe6029ac0a25da6319e026a2ceaead5496

    • SHA256

      0f4e00d3b7216fbcb95f9ecc438c3138563fc677609a169e86127eacfc809645

    • SHA512

      45bdb88e1d375e22d87edffd618fb2b65153249d32f2e6321775fcf898b70c00ff9453eeec86b90901fe342029a8ece9d27ae137ad644e7a46b728fd01d86afc

    • SSDEEP

      1536:HRqYOP7hiS8AnmQA7Dan/evV5k/tqHqkCGyv1fGgXRXLvL68VG5ExcSlExkg8F:HRqYOPli3Ana7GevC23C3f7cSlakgw

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks