Overview

overview

10

Static

static

3

b5e99dc096...54.exe

windows7-x64

10

b5e99dc096...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5e99dc09613954500d8207751f3721fc0f43a421c5ed345d0f35abbbbce8a54

  • Size

    96KB

  • Sample

    241210-asb7laxjes

  • MD5

    689e311ded039f60c1b77814c4a45ac8

  • SHA1

    8249a1ca5f6b2b12c45c93b74b861c273bf5ce94

  • SHA256

    b5e99dc09613954500d8207751f3721fc0f43a421c5ed345d0f35abbbbce8a54

  • SHA512

    a77a684334e9612507017ae04b2b49c0a532fe2805cd8162ee2cd4deec14a0957f5ffafc4777df3a8ee203e751a83404c0a53f7f1ac7ca4daa28155ec1cf8423

  • SSDEEP

    1536:nPcL9zTdUJo0jQo6Cjkk37fs1e6zoOuB3KNZUduV9jojTIvjr:kL9z5qjuCjv3bs1d63KNyd69jc0v

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b5e99dc09613954500d8207751f3721fc0f43a421c5ed345d0f35abbbbce8a54

    • Size

      96KB

    • MD5

      689e311ded039f60c1b77814c4a45ac8

    • SHA1

      8249a1ca5f6b2b12c45c93b74b861c273bf5ce94

    • SHA256

      b5e99dc09613954500d8207751f3721fc0f43a421c5ed345d0f35abbbbce8a54

    • SHA512

      a77a684334e9612507017ae04b2b49c0a532fe2805cd8162ee2cd4deec14a0957f5ffafc4777df3a8ee203e751a83404c0a53f7f1ac7ca4daa28155ec1cf8423

    • SSDEEP

      1536:nPcL9zTdUJo0jQo6Cjkk37fs1e6zoOuB3KNZUduV9jojTIvjr:kL9z5qjuCjv3bs1d63KNyd69jc0v

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks