Overview

overview

10

Static

static

3

593142e951...95.exe

windows7-x64

10

593142e951...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    593142e95120f93d072db18467c4d32007fa4c27c0b4f807ef305603584bde95

  • Size

    90KB

  • Sample

    241207-2vm6esykg1

  • MD5

    97674c2c07a107a32fd155779d211c77

  • SHA1

    173ae65bb22aead44cdebac03c7073fa2c4ae1eb

  • SHA256

    593142e95120f93d072db18467c4d32007fa4c27c0b4f807ef305603584bde95

  • SHA512

    5033cf1034bafb1bbf2a462b24df9f9df998155b1919db84e45af6f705c40afc3336f50a8bff039d6e9710e1708d425c3b0f52074c71cceadfbc5fea6e62b391

  • SSDEEP

    1536:MDAJKEirRA9Y5fQzrydUJ/i4AONC6QUwpoaGju/Ub0VkVNK:uA79YFQHyd+vHQNpNGju/Ub0+NK

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      593142e95120f93d072db18467c4d32007fa4c27c0b4f807ef305603584bde95

    • Size

      90KB

    • MD5

      97674c2c07a107a32fd155779d211c77

    • SHA1

      173ae65bb22aead44cdebac03c7073fa2c4ae1eb

    • SHA256

      593142e95120f93d072db18467c4d32007fa4c27c0b4f807ef305603584bde95

    • SHA512

      5033cf1034bafb1bbf2a462b24df9f9df998155b1919db84e45af6f705c40afc3336f50a8bff039d6e9710e1708d425c3b0f52074c71cceadfbc5fea6e62b391

    • SSDEEP

      1536:MDAJKEirRA9Y5fQzrydUJ/i4AONC6QUwpoaGju/Ub0VkVNK:uA79YFQHyd+vHQNpNGju/Ub0+NK

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks