Overview

overview

10

Static

static

3

68b063db6b...30.exe

windows7-x64

10

68b063db6b...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68b063db6b520bc57fea62ca2cf1c10ba4e2d72c43488687bea7ce3a71c07630

  • Size

    1000KB

  • Sample

    241207-3ecv7avmdj

  • MD5

    73ad60ef896ef190e3b80d17c30dcfde

  • SHA1

    872e3ef24d92a3db08bdb96033fb7d65848fda4f

  • SHA256

    68b063db6b520bc57fea62ca2cf1c10ba4e2d72c43488687bea7ce3a71c07630

  • SHA512

    f1b3cc77dce353522d547fcf80be9caf586ec17d6f4a3276350ec24e02e3fc6ea3fdc4d5d8fe21cbe147c3f63b003266d4d3721f0e4db24f9a0561cfdb956eea

  • SSDEEP

    6144:kpeBPpxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYyyPE:eWBtHBFLPj3TmLnWrOxNuxC97hFq9o7

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      68b063db6b520bc57fea62ca2cf1c10ba4e2d72c43488687bea7ce3a71c07630

    • Size

      1000KB

    • MD5

      73ad60ef896ef190e3b80d17c30dcfde

    • SHA1

      872e3ef24d92a3db08bdb96033fb7d65848fda4f

    • SHA256

      68b063db6b520bc57fea62ca2cf1c10ba4e2d72c43488687bea7ce3a71c07630

    • SHA512

      f1b3cc77dce353522d547fcf80be9caf586ec17d6f4a3276350ec24e02e3fc6ea3fdc4d5d8fe21cbe147c3f63b003266d4d3721f0e4db24f9a0561cfdb956eea

    • SSDEEP

      6144:kpeBPpxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCIIYyyPE:eWBtHBFLPj3TmLnWrOxNuxC97hFq9o7

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks