Overview

overview

10

Static

static

3

37e7fb05b0...32.exe

windows7-x64

10

37e7fb05b0...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37e7fb05b059263a5e81324d7c063cf9e7a0c7baca40a8c847558544772ee032

  • Size

    93KB

  • Sample

    241123-z5s4baxjhw

  • MD5

    5638970d9e40d0eb29ebf8da56e5a609

  • SHA1

    f9b27ebbe96d1896a622c5fc95b56ce3885c2815

  • SHA256

    37e7fb05b059263a5e81324d7c063cf9e7a0c7baca40a8c847558544772ee032

  • SHA512

    f0b116eb9244a1ca041635333086adb3ef983e281c2964536b3085b9bf82caf3797fd52f398488b6606d57402bd551a4ce556bb28f9eb30fffb6d7128632cc24

  • SSDEEP

    1536:FsvJsmSSc6HlFIRMP/ljIBDxlpyTvjiwg58Z:SvB26XIaXljIBD8XY58Z

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      37e7fb05b059263a5e81324d7c063cf9e7a0c7baca40a8c847558544772ee032

    • Size

      93KB

    • MD5

      5638970d9e40d0eb29ebf8da56e5a609

    • SHA1

      f9b27ebbe96d1896a622c5fc95b56ce3885c2815

    • SHA256

      37e7fb05b059263a5e81324d7c063cf9e7a0c7baca40a8c847558544772ee032

    • SHA512

      f0b116eb9244a1ca041635333086adb3ef983e281c2964536b3085b9bf82caf3797fd52f398488b6606d57402bd551a4ce556bb28f9eb30fffb6d7128632cc24

    • SSDEEP

      1536:FsvJsmSSc6HlFIRMP/ljIBDxlpyTvjiwg58Z:SvB26XIaXljIBD8XY58Z

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks