Overview

overview

10

Static

static

3

49c73f56d0...6f.exe

windows7-x64

10

49c73f56d0...6f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49c73f56d0ac2b84c43ac260a3ada499f17b207ccb888cbc474cf8c7a8513e6f

  • Size

    1.2MB

  • Sample

    241208-19zmbsznaj

  • MD5

    f9599d737b17830515cd402d90ed6659

  • SHA1

    fe7c08104b46f560f1cae57a1283377c601c7a1e

  • SHA256

    49c73f56d0ac2b84c43ac260a3ada499f17b207ccb888cbc474cf8c7a8513e6f

  • SHA512

    e2c555d77285ea2eebf20f0010c508f8dae53861cbe859b2c61a482bf218af0a349cf14e5976dea7c898a371a6f3fb3f7a399bd3351b9d2c1a889ca9afbc766d

  • SSDEEP

    12288:M6yu7haFHCXwpnsKvNA+XTvZHWuEo3oWbvrec:Qu7gZpsKv2EvZHp3oWbvrec

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      49c73f56d0ac2b84c43ac260a3ada499f17b207ccb888cbc474cf8c7a8513e6f

    • Size

      1.2MB

    • MD5

      f9599d737b17830515cd402d90ed6659

    • SHA1

      fe7c08104b46f560f1cae57a1283377c601c7a1e

    • SHA256

      49c73f56d0ac2b84c43ac260a3ada499f17b207ccb888cbc474cf8c7a8513e6f

    • SHA512

      e2c555d77285ea2eebf20f0010c508f8dae53861cbe859b2c61a482bf218af0a349cf14e5976dea7c898a371a6f3fb3f7a399bd3351b9d2c1a889ca9afbc766d

    • SSDEEP

      12288:M6yu7haFHCXwpnsKvNA+XTvZHWuEo3oWbvrec:Qu7gZpsKv2EvZHp3oWbvrec

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks