Overview

overview

10

Static

static

3

75ecf3c903...b9.exe

windows7-x64

10

75ecf3c903...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75ecf3c903527a127984715fb0b3d68dd1b6e7074c2f0f52b7288784db07dcb9

  • Size

    95KB

  • Sample

    241209-ac94pawncw

  • MD5

    537d48b074aca41a432fbdaedc829df7

  • SHA1

    da5f0cdc03a87cb8a790228a0af8c6ec5ff5710e

  • SHA256

    75ecf3c903527a127984715fb0b3d68dd1b6e7074c2f0f52b7288784db07dcb9

  • SHA512

    2a9d9a3fc8b45f00f91561ef560b95e7438a32794fd8713d34675d6a972c32b06398813394c9c935956d6aa20ab8aaac5ecfb5eab5f4035a38da2ec18d14b21c

  • SSDEEP

    1536:bRv17TLMc4I+yEEfFCzhWyI1nku8u2XjRQrIxRVRoRch1dROrwpOudRirVtFsrTO:bRdMpI+ypK9I1nku8u2XjewTWM1dQrTH

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      75ecf3c903527a127984715fb0b3d68dd1b6e7074c2f0f52b7288784db07dcb9

    • Size

      95KB

    • MD5

      537d48b074aca41a432fbdaedc829df7

    • SHA1

      da5f0cdc03a87cb8a790228a0af8c6ec5ff5710e

    • SHA256

      75ecf3c903527a127984715fb0b3d68dd1b6e7074c2f0f52b7288784db07dcb9

    • SHA512

      2a9d9a3fc8b45f00f91561ef560b95e7438a32794fd8713d34675d6a972c32b06398813394c9c935956d6aa20ab8aaac5ecfb5eab5f4035a38da2ec18d14b21c

    • SSDEEP

      1536:bRv17TLMc4I+yEEfFCzhWyI1nku8u2XjRQrIxRVRoRch1dROrwpOudRirVtFsrTO:bRdMpI+ypK9I1nku8u2XjewTWM1dQrTH

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks