Overview

overview

10

Static

static

3

4addf8ffbe...a1.exe

windows7-x64

10

4addf8ffbe...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4addf8ffbe5e47397a66393c74c8a5793dd0d2726a98631a82abe763c86f14a1

  • Size

    464KB

  • Sample

    241208-2b4dasvpby

  • MD5

    1471309c39ee46c3d44e796c8956caf8

  • SHA1

    2994cee4d783da22262b431c2f81e01832cbfb69

  • SHA256

    4addf8ffbe5e47397a66393c74c8a5793dd0d2726a98631a82abe763c86f14a1

  • SHA512

    238b99b08126ccf78069bfc2e76c8d6eb1b2e043a83f911e85d2ae8bc527130f90d4f53d3017adee51d79fc8bc89672e95d48bf0a7e7a285789d44196951c812

  • SSDEEP

    12288:X/Pah2kkkkK4kXkkkkkkkkl888888888888888888nusG:X/Pah2kkkkK4kXkkkkkkkkK

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      4addf8ffbe5e47397a66393c74c8a5793dd0d2726a98631a82abe763c86f14a1

    • Size

      464KB

    • MD5

      1471309c39ee46c3d44e796c8956caf8

    • SHA1

      2994cee4d783da22262b431c2f81e01832cbfb69

    • SHA256

      4addf8ffbe5e47397a66393c74c8a5793dd0d2726a98631a82abe763c86f14a1

    • SHA512

      238b99b08126ccf78069bfc2e76c8d6eb1b2e043a83f911e85d2ae8bc527130f90d4f53d3017adee51d79fc8bc89672e95d48bf0a7e7a285789d44196951c812

    • SSDEEP

      12288:X/Pah2kkkkK4kXkkkkkkkkl888888888888888888nusG:X/Pah2kkkkK4kXkkkkkkkkK

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks