Overview

overview

10

Static

static

10

a1582e4787...d7.exe

windows7-x64

10

a1582e4787...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1582e4787cd9347f74fba6564c476ddcee976966e7a544271a2a3513fdf2dd7.exe

  • Size

    520KB

  • Sample

    241207-mj5trsylh1

  • MD5

    db49e4292f95cb3198891ce9a2b539bd

  • SHA1

    f58964a9df54a1bc5d34503990bfe1668981fb7c

  • SHA256

    a1582e4787cd9347f74fba6564c476ddcee976966e7a544271a2a3513fdf2dd7

  • SHA512

    359c0066396e0a4d5c8615cabdef5eb1a604c29d6b64e68c539ac1238cca5c259032eb638e43c180027b8ff512b6c12855e55ce82a197b3dca2fd8ecc41c2b4d

  • SSDEEP

    6144:2E7X1zEvFM6234lKm3mo8Yvi4KsLTFM6234lKm3r8SeNpgdyuH1lZfRo0V8JcgE3:77FSFB24lwR45FB24lJ87g7/VycgE3

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a1582e4787cd9347f74fba6564c476ddcee976966e7a544271a2a3513fdf2dd7.exe

    • Size

      520KB

    • MD5

      db49e4292f95cb3198891ce9a2b539bd

    • SHA1

      f58964a9df54a1bc5d34503990bfe1668981fb7c

    • SHA256

      a1582e4787cd9347f74fba6564c476ddcee976966e7a544271a2a3513fdf2dd7

    • SHA512

      359c0066396e0a4d5c8615cabdef5eb1a604c29d6b64e68c539ac1238cca5c259032eb638e43c180027b8ff512b6c12855e55ce82a197b3dca2fd8ecc41c2b4d

    • SSDEEP

      6144:2E7X1zEvFM6234lKm3mo8Yvi4KsLTFM6234lKm3r8SeNpgdyuH1lZfRo0V8JcgE3:77FSFB24lwR45FB24lJ87g7/VycgE3

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks