Overview

overview

10

Static

static

10

e99814a156...56.exe

windows7-x64

10

e99814a156...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e99814a1569883621339a74c0dd4b1037bbf2dbb1f5d2ed74c07d8f0e9298256

  • Size

    128KB

  • Sample

    241209-es8ysavjgl

  • MD5

    cb785ef7678308724444508fe4e4af07

  • SHA1

    e839147231ac041162d91060dcc2dbcf148ba9be

  • SHA256

    e99814a1569883621339a74c0dd4b1037bbf2dbb1f5d2ed74c07d8f0e9298256

  • SHA512

    743d96831533432d4f8405e39d0bfb80c4a402809a669b1516442ce023f45d69f071e5401130f56d23ce79ff01871d80ef120fa9283c586ce5e69a666a58a04a

  • SSDEEP

    3072:59ISfyjNtgC2+IJkMi/T84PxMeEvPOdgujv6NLPfFFrKP9:QSwPv2LiI4JML3OdgawrFZKP

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e99814a1569883621339a74c0dd4b1037bbf2dbb1f5d2ed74c07d8f0e9298256

    • Size

      128KB

    • MD5

      cb785ef7678308724444508fe4e4af07

    • SHA1

      e839147231ac041162d91060dcc2dbcf148ba9be

    • SHA256

      e99814a1569883621339a74c0dd4b1037bbf2dbb1f5d2ed74c07d8f0e9298256

    • SHA512

      743d96831533432d4f8405e39d0bfb80c4a402809a669b1516442ce023f45d69f071e5401130f56d23ce79ff01871d80ef120fa9283c586ce5e69a666a58a04a

    • SSDEEP

      3072:59ISfyjNtgC2+IJkMi/T84PxMeEvPOdgujv6NLPfFFrKP9:QSwPv2LiI4JML3OdgawrFZKP

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks