Overview

overview

10

Static

static

3

96f5006a3d...dN.exe

windows7-x64

10

96f5006a3d...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96f5006a3d2321d1108af55c4cf168790efb4a043d032c6548742c1a288a805dN.exe

  • Size

    1.3MB

  • Sample

    241208-aaj5gs1mfx

  • MD5

    d6181f9471822f963be6c71c64992540

  • SHA1

    f1862c963cb313f47b5c38496fce922246c03a8c

  • SHA256

    96f5006a3d2321d1108af55c4cf168790efb4a043d032c6548742c1a288a805d

  • SHA512

    0c1599cd925cd7a32bcb96a86adb9933b24381d35016c5a4e754a8616ffb6636fcec49af0f4b370c8ae4dff316cdfc1006573c1ae4ec307202f315be30a4b4cf

  • SSDEEP

    12288:SSTMedIWzAbaz22cWfVaw0HBHY8r8ABjMn:bMeaWzsaK2cWfVaw0HB48r8ABY

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      96f5006a3d2321d1108af55c4cf168790efb4a043d032c6548742c1a288a805dN.exe

    • Size

      1.3MB

    • MD5

      d6181f9471822f963be6c71c64992540

    • SHA1

      f1862c963cb313f47b5c38496fce922246c03a8c

    • SHA256

      96f5006a3d2321d1108af55c4cf168790efb4a043d032c6548742c1a288a805d

    • SHA512

      0c1599cd925cd7a32bcb96a86adb9933b24381d35016c5a4e754a8616ffb6636fcec49af0f4b370c8ae4dff316cdfc1006573c1ae4ec307202f315be30a4b4cf

    • SSDEEP

      12288:SSTMedIWzAbaz22cWfVaw0HBHY8r8ABjMn:bMeaWzsaK2cWfVaw0HB48r8ABY

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks