Extracted

• • Target

    f4e11f8d2b1c2be3bcd24cb21a561cc05d7c1cfb405a7c6839ca20cc6883a4bcN.exe

  • Size

    800KB

  • MD5

    01be475a8340129be2fada603061d830

  • SHA1

    a8f971b3872f630be86051712142d0564649c6f3

  • SHA256

    f4e11f8d2b1c2be3bcd24cb21a561cc05d7c1cfb405a7c6839ca20cc6883a4bc

  • SHA512

    ba9ae7e55add0e354b16913dda961f8b54eff8821d8a722e972e4564bda08400e024f19baa3d0ffd2a0a6ffcc1ce27efdc152685f25ce8996f87b3c4d64b79e6

  • SSDEEP

    12288:S+K/+zrWAI5KFum/+zrWAIAqWim/+zrWAI5KFHTP7rXFr/+zrWAI5KFum/+zrWAE:HKm0BmmvFimm0MTP7hm0BmmvK

  Score

  10^/10

  berbewbackdoordiscoverypersistence

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Berbew family

    berbew

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2