Overview

overview

10

Static

static

3

1cd976d4e5...6c.exe

windows7-x64

10

1cd976d4e5...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cd976d4e5527150be8bef517e0dfa3326d1bf2929c7b6b32d16c9faf99ad26c

  • Size

    97KB

  • Sample

    241207-y4y3haxjhm

  • MD5

    839e057f7c243c4fc07d1e69e33c34ce

  • SHA1

    8e83383ee5cb85d6fcd957ea64694fe9154767ce

  • SHA256

    1cd976d4e5527150be8bef517e0dfa3326d1bf2929c7b6b32d16c9faf99ad26c

  • SHA512

    1e5778a0e1435fc418dea140aa94342e9d80a8e3aa3c6cb435b3b54896de8c78aac88ad6a2b55b38cc2c1aea00f79d4f8b7d329f5adbde14ab751efb255d24d8

  • SSDEEP

    1536:bCuoMRocXcLjZsXtBpp0rJ0+1bK0SGZhc930Yn5Y6Ozbq+vJXeYZ6:6nNLjS2t0+Y0SF9F5dOzbqWJXeK6

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      1cd976d4e5527150be8bef517e0dfa3326d1bf2929c7b6b32d16c9faf99ad26c

    • Size

      97KB

    • MD5

      839e057f7c243c4fc07d1e69e33c34ce

    • SHA1

      8e83383ee5cb85d6fcd957ea64694fe9154767ce

    • SHA256

      1cd976d4e5527150be8bef517e0dfa3326d1bf2929c7b6b32d16c9faf99ad26c

    • SHA512

      1e5778a0e1435fc418dea140aa94342e9d80a8e3aa3c6cb435b3b54896de8c78aac88ad6a2b55b38cc2c1aea00f79d4f8b7d329f5adbde14ab751efb255d24d8

    • SSDEEP

      1536:bCuoMRocXcLjZsXtBpp0rJ0+1bK0SGZhc930Yn5Y6Ozbq+vJXeYZ6:6nNLjS2t0+Y0SF9F5dOzbqWJXeK6

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks