Overview

overview

10

Static

static

3

12850c59cb...3c.exe

windows7-x64

10

12850c59cb...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12850c59cb556834cfd7faad3d18fbb2515108dc0013e082c5fd9b9debbd433c

  • Size

    296KB

  • Sample

    241208-ym1vrsyjek

  • MD5

    e25a5eb6ff9fc680ce7c33c953f587f5

  • SHA1

    32b221ef1005226f5f82bf894dcaab5848b70e00

  • SHA256

    12850c59cb556834cfd7faad3d18fbb2515108dc0013e082c5fd9b9debbd433c

  • SHA512

    1f562e667efd8c3e06bff7e592ceb6d275d2488a1f1ef156ded397b3a815c170ac77428f1d040877abe22859b6e0a9af17814abd34760469dae7faa89f8df4de

  • SSDEEP

    3072:NPcJQZ2c8+KYsEXNjShiKuARA1+6NhZ6P0c9fpxg6pg:NH2wXdShJkNPKG6g

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      12850c59cb556834cfd7faad3d18fbb2515108dc0013e082c5fd9b9debbd433c

    • Size

      296KB

    • MD5

      e25a5eb6ff9fc680ce7c33c953f587f5

    • SHA1

      32b221ef1005226f5f82bf894dcaab5848b70e00

    • SHA256

      12850c59cb556834cfd7faad3d18fbb2515108dc0013e082c5fd9b9debbd433c

    • SHA512

      1f562e667efd8c3e06bff7e592ceb6d275d2488a1f1ef156ded397b3a815c170ac77428f1d040877abe22859b6e0a9af17814abd34760469dae7faa89f8df4de

    • SSDEEP

      3072:NPcJQZ2c8+KYsEXNjShiKuARA1+6NhZ6P0c9fpxg6pg:NH2wXdShJkNPKG6g

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks