Overview

overview

10

Static

static

3

92c4259aa2...26.exe

windows7-x64

10

92c4259aa2...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92c4259aa2ca0adebc8ed47b3a1fad478bc182365d6a1143c22d93e90f12d326

  • Size

    128KB

  • Sample

    241208-be22jatnbv

  • MD5

    da1d94cc1fac15d7e9ef81eae5411d67

  • SHA1

    93ee2b77a9cad58eb58bdb28e8ccf2c0652c1e25

  • SHA256

    92c4259aa2ca0adebc8ed47b3a1fad478bc182365d6a1143c22d93e90f12d326

  • SHA512

    3954d0af8d89b8ace29694888e7e91b2f803df3873753ab14e1c5c7b8edfcd8b290cf8ae28a3a95e37105446473f5085e46fba0ee3027f42b5e9d39798b1fec4

  • SSDEEP

    3072:fXrSZtqsqw1L/vzwU9CFe5ox7cEGrhkngpDvchkqbAIQxgFM9MD:GZ4s3JCo5ox4brq2Ah1FM6D

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      92c4259aa2ca0adebc8ed47b3a1fad478bc182365d6a1143c22d93e90f12d326

    • Size

      128KB

    • MD5

      da1d94cc1fac15d7e9ef81eae5411d67

    • SHA1

      93ee2b77a9cad58eb58bdb28e8ccf2c0652c1e25

    • SHA256

      92c4259aa2ca0adebc8ed47b3a1fad478bc182365d6a1143c22d93e90f12d326

    • SHA512

      3954d0af8d89b8ace29694888e7e91b2f803df3873753ab14e1c5c7b8edfcd8b290cf8ae28a3a95e37105446473f5085e46fba0ee3027f42b5e9d39798b1fec4

    • SSDEEP

      3072:fXrSZtqsqw1L/vzwU9CFe5ox7cEGrhkngpDvchkqbAIQxgFM9MD:GZ4s3JCo5ox4brq2Ah1FM6D

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks