Overview

overview

10

Static

static

3

146269ca40...ef.exe

windows7-x64

10

146269ca40...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    146269ca403b4757371f15737b94acd6915739db1f9983501dce7e23ec79efef

  • Size

    93KB

  • Sample

    241207-yrmtpswmek

  • MD5

    da6cc6a16bfc2c8d315aca2030c9e3d6

  • SHA1

    fd3eebab087b0c1fcafce1db74d255215698b6ae

  • SHA256

    146269ca403b4757371f15737b94acd6915739db1f9983501dce7e23ec79efef

  • SHA512

    a45d1ac9076646a1c93b5eb4ea8d3c7eb9858021cb08e880fad755b560d90759fd87930452df1ce13ad0b53001c84cf515f03d2ed76bf751793cca981de6e286

  • SSDEEP

    1536:7gMo2GaH/ivm+uZtPdl3Q8zmNTmeYYkQIsRQpRkRLJzeLD9N0iQGRNQR8RyV+32n:BGuShoXlALBJYYvepSJdEN0s4WE+3e

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      146269ca403b4757371f15737b94acd6915739db1f9983501dce7e23ec79efef

    • Size

      93KB

    • MD5

      da6cc6a16bfc2c8d315aca2030c9e3d6

    • SHA1

      fd3eebab087b0c1fcafce1db74d255215698b6ae

    • SHA256

      146269ca403b4757371f15737b94acd6915739db1f9983501dce7e23ec79efef

    • SHA512

      a45d1ac9076646a1c93b5eb4ea8d3c7eb9858021cb08e880fad755b560d90759fd87930452df1ce13ad0b53001c84cf515f03d2ed76bf751793cca981de6e286

    • SSDEEP

      1536:7gMo2GaH/ivm+uZtPdl3Q8zmNTmeYYkQIsRQpRkRLJzeLD9N0iQGRNQR8RyV+32n:BGuShoXlALBJYYvepSJdEN0s4WE+3e

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks