Overview

overview

10

Static

static

3

b141b74db1...cd.exe

windows7-x64

10

b141b74db1...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b141b74db18e55c9d1786c604a1d42a2ac0b86e5fbd4833f23377f26d169accd

  • Size

    470KB

  • Sample

    241208-clwc1askaj

  • MD5

    d9e94d1c22379940203ab5231b820013

  • SHA1

    d6046be075d2205370cdb43c55c5185c07ac8fc3

  • SHA256

    b141b74db18e55c9d1786c604a1d42a2ac0b86e5fbd4833f23377f26d169accd

  • SHA512

    8f4a79c8319a42f49a3627af6a4bd4e25c97d42887f8368ebd320510839819ae4445399c43e9f2aa28421dd0006856b9900b04ba783fa5d833a1596dfd31a3b0

  • SSDEEP

    12288:w8S/cgr/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8N:w84746

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b141b74db18e55c9d1786c604a1d42a2ac0b86e5fbd4833f23377f26d169accd

    • Size

      470KB

    • MD5

      d9e94d1c22379940203ab5231b820013

    • SHA1

      d6046be075d2205370cdb43c55c5185c07ac8fc3

    • SHA256

      b141b74db18e55c9d1786c604a1d42a2ac0b86e5fbd4833f23377f26d169accd

    • SHA512

      8f4a79c8319a42f49a3627af6a4bd4e25c97d42887f8368ebd320510839819ae4445399c43e9f2aa28421dd0006856b9900b04ba783fa5d833a1596dfd31a3b0

    • SSDEEP

      12288:w8S/cgr/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8N:w84746

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks