Overview

overview

10

Static

static

10

1bc6bb52fb...cN.exe

windows7-x64

10

1bc6bb52fb...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1bc6bb52fbbba62e317e307d75258f7145fb2fe769eb79b08ddad4890034eaccN.exe

  • Size

    419KB

  • Sample

    241208-bsgmravkew

  • MD5

    b0c55bec96d2818ca6205038abf8da80

  • SHA1

    80c8717f439f827ad272ba4543ff1e993e00ac57

  • SHA256

    1bc6bb52fbbba62e317e307d75258f7145fb2fe769eb79b08ddad4890034eacc

  • SHA512

    59e30f6b6ab740c7d6f738585cf6322359ee249b4a7264f6259f9cd79184f326890b8359f872ae652494f027bb4c8ef6739d802d20c9c80305eaf80e056bf449

  • SSDEEP

    6144:lozaGl35IKof8ByvZ6Mxv5Rar3O6B9fZSLhZmzbByvZ6Mxv5R1L/gBSfGmtE1se:mliK9ByvNv54B9f01ZmHByvNv5fJPGs

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      1bc6bb52fbbba62e317e307d75258f7145fb2fe769eb79b08ddad4890034eaccN.exe

    • Size

      419KB

    • MD5

      b0c55bec96d2818ca6205038abf8da80

    • SHA1

      80c8717f439f827ad272ba4543ff1e993e00ac57

    • SHA256

      1bc6bb52fbbba62e317e307d75258f7145fb2fe769eb79b08ddad4890034eacc

    • SHA512

      59e30f6b6ab740c7d6f738585cf6322359ee249b4a7264f6259f9cd79184f326890b8359f872ae652494f027bb4c8ef6739d802d20c9c80305eaf80e056bf449

    • SSDEEP

      6144:lozaGl35IKof8ByvZ6Mxv5Rar3O6B9fZSLhZmzbByvZ6Mxv5R1L/gBSfGmtE1se:mliK9ByvNv54B9f01ZmHByvNv5fJPGs

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks