Overview

overview

10

Static

static

3

3e69c0441e...1c.exe

windows7-x64

10

3e69c0441e...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e69c0441e7fff0051431fa26c31ee47000ac71e8ee435076cadef5b555b9e1c.exe

  • Size

    896KB

  • Sample

    241123-ze3j3avpcx

  • MD5

    84b050c3a219f389e6e53777fbb61050

  • SHA1

    6840cb49ae2de0af5559edff8e59e94b1f1e2f8a

  • SHA256

    3e69c0441e7fff0051431fa26c31ee47000ac71e8ee435076cadef5b555b9e1c

  • SHA512

    69165dfbc784bbb1698f150bab531acb3ffe6e14e57493a6f2cb25950c36adda357c7f999a5ef781e79e340cbc0b32c071d621873dcd2bc87cdf3d263124664c

  • SSDEEP

    12288:RtqWByvNv54B9f01ZmqLonfBHLqF1Nw5ILonfByvNv5Hf:kvr4B9f01ZmoENOVvr/

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      3e69c0441e7fff0051431fa26c31ee47000ac71e8ee435076cadef5b555b9e1c.exe

    • Size

      896KB

    • MD5

      84b050c3a219f389e6e53777fbb61050

    • SHA1

      6840cb49ae2de0af5559edff8e59e94b1f1e2f8a

    • SHA256

      3e69c0441e7fff0051431fa26c31ee47000ac71e8ee435076cadef5b555b9e1c

    • SHA512

      69165dfbc784bbb1698f150bab531acb3ffe6e14e57493a6f2cb25950c36adda357c7f999a5ef781e79e340cbc0b32c071d621873dcd2bc87cdf3d263124664c

    • SSDEEP

      12288:RtqWByvNv54B9f01ZmqLonfBHLqF1Nw5ILonfByvNv5Hf:kvr4B9f01ZmoENOVvr/

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks