Overview

overview

10

Static

static

3

daadf674f8...22.exe

windows7-x64

10

daadf674f8...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daadf674f82a14481a63ff20661b57a22fcf983c155874f2f53517f72b76f822

  • Size

    96KB

  • Sample

    241208-d8m6ks1kbs

  • MD5

    617a379d4d71d22858a2f16c55800202

  • SHA1

    210a409e72a3ea4644294737382cc408c4bea167

  • SHA256

    daadf674f82a14481a63ff20661b57a22fcf983c155874f2f53517f72b76f822

  • SHA512

    b7cec00073716956825ca1cdba18f88178d53a29507a79a4968b695aaa433673d58d3c6741a0208fb2b1fcdadac72ba110b560cfcb1a1f7ddb0f07aba8297a9b

  • SSDEEP

    1536:3QXKp5I6cR4bY689NhneIWW0+deotGIPmtZ0dyP1VYcImvFJNiA0/BOmYCMy0Qir:3k6sz9PnRpdevIPmtZpP1f5vTNiA05Ob

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      daadf674f82a14481a63ff20661b57a22fcf983c155874f2f53517f72b76f822

    • Size

      96KB

    • MD5

      617a379d4d71d22858a2f16c55800202

    • SHA1

      210a409e72a3ea4644294737382cc408c4bea167

    • SHA256

      daadf674f82a14481a63ff20661b57a22fcf983c155874f2f53517f72b76f822

    • SHA512

      b7cec00073716956825ca1cdba18f88178d53a29507a79a4968b695aaa433673d58d3c6741a0208fb2b1fcdadac72ba110b560cfcb1a1f7ddb0f07aba8297a9b

    • SSDEEP

      1536:3QXKp5I6cR4bY689NhneIWW0+deotGIPmtZ0dyP1VYcImvFJNiA0/BOmYCMy0Qir:3k6sz9PnRpdevIPmtZpP1f5vTNiA05Ob

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks