Overview

overview

10

Static

static

10

c73f12a370...2N.exe

windows7-x64

10

c73f12a370...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c73f12a3706d352edd9c00a1fc6fc744c2a471c0e6873c0698da5615a6369982N.exe

  • Size

    402KB

  • Sample

    241207-2ze1lsymfv

  • MD5

    9b9ed4de2820dd0080e7c9c8e53f63b0

  • SHA1

    5f521dd1395e64be70f7f150bc4cf749b7e01adc

  • SHA256

    c73f12a3706d352edd9c00a1fc6fc744c2a471c0e6873c0698da5615a6369982

  • SHA512

    cbe1e8854c88fc3c7c152a427fa10535a93e0353f885b09d913b7333e04ff73764682f82dde0353f71bcca61e8f0f7f6ff6fc13133763cc0ac56bd6764958f0b

  • SSDEEP

    6144:iDusewXPv2EnsSO9PvTpN0xHuwdkAj51VezfHZ3neNZpGkXo+TCCYOs5PHdC:4Pe+IU

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c73f12a3706d352edd9c00a1fc6fc744c2a471c0e6873c0698da5615a6369982N.exe

    • Size

      402KB

    • MD5

      9b9ed4de2820dd0080e7c9c8e53f63b0

    • SHA1

      5f521dd1395e64be70f7f150bc4cf749b7e01adc

    • SHA256

      c73f12a3706d352edd9c00a1fc6fc744c2a471c0e6873c0698da5615a6369982

    • SHA512

      cbe1e8854c88fc3c7c152a427fa10535a93e0353f885b09d913b7333e04ff73764682f82dde0353f71bcca61e8f0f7f6ff6fc13133763cc0ac56bd6764958f0b

    • SSDEEP

      6144:iDusewXPv2EnsSO9PvTpN0xHuwdkAj51VezfHZ3neNZpGkXo+TCCYOs5PHdC:4Pe+IU

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks