Overview

overview

10

Static

static

3

52135cd2a3...25.exe

windows7-x64

10

52135cd2a3...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    52135cd2a3ca9b5629e57246d8d702ad85015e175b2a4c2f1dc6e602a0638525

  • Size

    80KB

  • Sample

    241209-1jppfaxmaq

  • MD5

    b759d15e7ecec80cf665fc2414a50224

  • SHA1

    21e5230df60dbbabcb2afdf914a0a8ccee2bc928

  • SHA256

    52135cd2a3ca9b5629e57246d8d702ad85015e175b2a4c2f1dc6e602a0638525

  • SHA512

    26d07db56f5f878c4b2616396a899195dc2a0dbb8a7c6a41df7f05a3aba3781b4e70cc191f587a3b3ff4b6be6b2ecf2d602603db7c50bbf445d6c40fef93e37d

  • SSDEEP

    1536:ZZWWtGeHv0t3I7/NvwTS0KhAF1VdTz3QfhZhkFeJuqnhCN:2Wtfv0t3qeTxKheVdTz3QDhkFeJLCN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      52135cd2a3ca9b5629e57246d8d702ad85015e175b2a4c2f1dc6e602a0638525

    • Size

      80KB

    • MD5

      b759d15e7ecec80cf665fc2414a50224

    • SHA1

      21e5230df60dbbabcb2afdf914a0a8ccee2bc928

    • SHA256

      52135cd2a3ca9b5629e57246d8d702ad85015e175b2a4c2f1dc6e602a0638525

    • SHA512

      26d07db56f5f878c4b2616396a899195dc2a0dbb8a7c6a41df7f05a3aba3781b4e70cc191f587a3b3ff4b6be6b2ecf2d602603db7c50bbf445d6c40fef93e37d

    • SSDEEP

      1536:ZZWWtGeHv0t3I7/NvwTS0KhAF1VdTz3QfhZhkFeJuqnhCN:2Wtfv0t3qeTxKheVdTz3QDhkFeJLCN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks