Overview

overview

10

Static

static

3

61d74d9b56...be.exe

windows7-x64

10

61d74d9b56...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61d74d9b567dbdc95f09bb47233f5e5f6aad36b5034fbb2bba4a0929c2633abe

  • Size

    90KB

  • Sample

    241207-25vcgstrfq

  • MD5

    85ca7484985694ab08e91acf9602f0ff

  • SHA1

    a1881f7e2eb41ca2f69fd453a5ebf607981cf2c0

  • SHA256

    61d74d9b567dbdc95f09bb47233f5e5f6aad36b5034fbb2bba4a0929c2633abe

  • SHA512

    c783cc9220644b6c71d3570cc022bb9344961f014424ad88a7089b8a7b7dc77b239ec0cec063eb6492e3ca01b08418cf61699ce1eb97491c310748360bc9e2d6

  • SSDEEP

    1536:IuAR5RP5oC0gD92MdNBTtMrs+Nuj7TLh7nSR0NARYeCkEvJpGJT/cG9u/Ub0VkV/:InrRGC0ybdNxqrZ61nPGJTcG9u/Ub0+/

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      61d74d9b567dbdc95f09bb47233f5e5f6aad36b5034fbb2bba4a0929c2633abe

    • Size

      90KB

    • MD5

      85ca7484985694ab08e91acf9602f0ff

    • SHA1

      a1881f7e2eb41ca2f69fd453a5ebf607981cf2c0

    • SHA256

      61d74d9b567dbdc95f09bb47233f5e5f6aad36b5034fbb2bba4a0929c2633abe

    • SHA512

      c783cc9220644b6c71d3570cc022bb9344961f014424ad88a7089b8a7b7dc77b239ec0cec063eb6492e3ca01b08418cf61699ce1eb97491c310748360bc9e2d6

    • SSDEEP

      1536:IuAR5RP5oC0gD92MdNBTtMrs+Nuj7TLh7nSR0NARYeCkEvJpGJT/cG9u/Ub0VkV/:InrRGC0ybdNxqrZ61nPGJTcG9u/Ub0+/

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks