Overview

overview

10

Static

static

3

6e9c8e62c7...4a.exe

windows7-x64

10

6e9c8e62c7...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e9c8e62c7f48786b60d25f660aa4cd7b78cd3df9250a831559fb45c6cffee4a

  • Size

    87KB

  • Sample

    241207-3qg92szrct

  • MD5

    5ccd03dece55af83b60c11fc88b9110d

  • SHA1

    3be841c45d481fb16e1528957e15563b19f534fc

  • SHA256

    6e9c8e62c7f48786b60d25f660aa4cd7b78cd3df9250a831559fb45c6cffee4a

  • SHA512

    89ae94d7e46bb965ffddd3f42af8d25576aff073a4f40d295bb541aa0a118d83e2d6293712fcaabf2fe4fbde9ad572db3de46adff87a9e167b09f42600457a94

  • SSDEEP

    1536:Odn044ZwIbNbEKR0OR8DftnqWla2UeK2ikRQ4xRSRBDNrR0RVe7R6R8RPD2zx:mt4ZwIZbPKq8Dfc0a+9e4AnDlmbGcGFk

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6e9c8e62c7f48786b60d25f660aa4cd7b78cd3df9250a831559fb45c6cffee4a

    • Size

      87KB

    • MD5

      5ccd03dece55af83b60c11fc88b9110d

    • SHA1

      3be841c45d481fb16e1528957e15563b19f534fc

    • SHA256

      6e9c8e62c7f48786b60d25f660aa4cd7b78cd3df9250a831559fb45c6cffee4a

    • SHA512

      89ae94d7e46bb965ffddd3f42af8d25576aff073a4f40d295bb541aa0a118d83e2d6293712fcaabf2fe4fbde9ad572db3de46adff87a9e167b09f42600457a94

    • SSDEEP

      1536:Odn044ZwIbNbEKR0OR8DftnqWla2UeK2ikRQ4xRSRBDNrR0RVe7R6R8RPD2zx:mt4ZwIZbPKq8Dfc0a+9e4AnDlmbGcGFk

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks