Overview

overview

10

Static

static

3

382940a861...c1.exe

windows7-x64

10

382940a861...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    382940a8615b9b3fd9c0ad7c6dc56308bcb03e10666357091eb0f45f2b78f8c1

  • Size

    96KB

  • Sample

    241123-z6ay5atkfk

  • MD5

    0d7ffd39760c0b0931593d3239d48144

  • SHA1

    c595b37d707f5743591184b0ab6196933ca9e5c2

  • SHA256

    382940a8615b9b3fd9c0ad7c6dc56308bcb03e10666357091eb0f45f2b78f8c1

  • SHA512

    7ceb0f36dd1900726e438f230949d7d2eab2f4cd12c6551102a22fcab280e811037aef4f7c651a3e81ed63a5ed0dcb023c79c1a0627efd7e3d0e8d83e7cd0f50

  • SSDEEP

    1536:w5lcCdKk7xlMq+n9mh1+ihC7emHgOjdAeDXX9EfvuPQjSlj/9oXyN3duV9jojTIX:w0Qddlk9X6C71LcSoCN3d69jc0vf

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      382940a8615b9b3fd9c0ad7c6dc56308bcb03e10666357091eb0f45f2b78f8c1

    • Size

      96KB

    • MD5

      0d7ffd39760c0b0931593d3239d48144

    • SHA1

      c595b37d707f5743591184b0ab6196933ca9e5c2

    • SHA256

      382940a8615b9b3fd9c0ad7c6dc56308bcb03e10666357091eb0f45f2b78f8c1

    • SHA512

      7ceb0f36dd1900726e438f230949d7d2eab2f4cd12c6551102a22fcab280e811037aef4f7c651a3e81ed63a5ed0dcb023c79c1a0627efd7e3d0e8d83e7cd0f50

    • SSDEEP

      1536:w5lcCdKk7xlMq+n9mh1+ihC7emHgOjdAeDXX9EfvuPQjSlj/9oXyN3duV9jojTIX:w0Qddlk9X6C71LcSoCN3d69jc0vf

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks