Overview

overview

10

Static

static

3

f77705bf03...1N.exe

windows7-x64

10

f77705bf03...1N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f77705bf0312fb624b167175b9864abc2f18ccfb776b4bb5b301cc8324cbb851N.exe

  • Size

    93KB

  • Sample

    241208-bsztbszpbq

  • MD5

    daeb26d0bc4ae7ca4481f7fcd01d8010

  • SHA1

    732bd1c4f2e197cab7381df9f2de937e7c7b7048

  • SHA256

    f77705bf0312fb624b167175b9864abc2f18ccfb776b4bb5b301cc8324cbb851

  • SHA512

    e486720174e21fb6e78ebb6d84ceaada41ca68c450cfaad930171548ae3aa2b04da0bae3a7de0972ed229f126ee507b20db4b8167e0b3396179a5d5a11c79a4f

  • SSDEEP

    1536:J8OLtR+bzXFJWQBIZqvA38aa5GO5yK2lRQaRRs3cO57OWxXPu4n6yYPLBgI7Ckt:JebzO6gf7CH2leaE9pui6yYPaI7Dt

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f77705bf0312fb624b167175b9864abc2f18ccfb776b4bb5b301cc8324cbb851N.exe

    • Size

      93KB

    • MD5

      daeb26d0bc4ae7ca4481f7fcd01d8010

    • SHA1

      732bd1c4f2e197cab7381df9f2de937e7c7b7048

    • SHA256

      f77705bf0312fb624b167175b9864abc2f18ccfb776b4bb5b301cc8324cbb851

    • SHA512

      e486720174e21fb6e78ebb6d84ceaada41ca68c450cfaad930171548ae3aa2b04da0bae3a7de0972ed229f126ee507b20db4b8167e0b3396179a5d5a11c79a4f

    • SSDEEP

      1536:J8OLtR+bzXFJWQBIZqvA38aa5GO5yK2lRQaRRs3cO57OWxXPu4n6yYPLBgI7Ckt:JebzO6gf7CH2leaE9pui6yYPaI7Dt

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks