Overview

overview

10

Static

static

3

32b65afb59...6b.exe

windows7-x64

10

32b65afb59...6b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32b65afb598a67bb0575f1f641a92116c62f5d438265885dffb248873ac8496b

  • Size

    88KB

  • Sample

    241208-z8by7svjcv

  • MD5

    60cfae2f35010c3e9bb9c7071cdba23b

  • SHA1

    9752d78fba0c89d494adfc8b08fb10e5e33e4341

  • SHA256

    32b65afb598a67bb0575f1f641a92116c62f5d438265885dffb248873ac8496b

  • SHA512

    7e26c647313387773e7d438425d72d5b37a0476ab71f3d2cdad5cec7dc4a6047d3ef24bf59014d6f43798b3e45b7b0dfe1835a9d3a8f696846cf5e02df4ef667

  • SSDEEP

    1536:+Xt6xiP78h5ygt+zsF/jUzBpbgDRRytyBwnouy8B:8c4P78hl+oF/aBpbgDRRytyWoutB

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      32b65afb598a67bb0575f1f641a92116c62f5d438265885dffb248873ac8496b

    • Size

      88KB

    • MD5

      60cfae2f35010c3e9bb9c7071cdba23b

    • SHA1

      9752d78fba0c89d494adfc8b08fb10e5e33e4341

    • SHA256

      32b65afb598a67bb0575f1f641a92116c62f5d438265885dffb248873ac8496b

    • SHA512

      7e26c647313387773e7d438425d72d5b37a0476ab71f3d2cdad5cec7dc4a6047d3ef24bf59014d6f43798b3e45b7b0dfe1835a9d3a8f696846cf5e02df4ef667

    • SSDEEP

      1536:+Xt6xiP78h5ygt+zsF/jUzBpbgDRRytyBwnouy8B:8c4P78hl+oF/aBpbgDRRytyWoutB

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks