Overview

overview

10

Static

static

3

e2fb40bb71...ed.exe

windows7-x64

10

e2fb40bb71...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2fb40bb71146cf53cca03b4323f7c449c3de67aacfe624673a1417b772c7ced

  • Size

    790KB

  • Sample

    241210-b66h2ayqfx

  • MD5

    eef10bd401bfdae5030b22f8d75e63bf

  • SHA1

    0b5540ccfe1e9f385c36b96b1ac2fd7e48ed6f91

  • SHA256

    e2fb40bb71146cf53cca03b4323f7c449c3de67aacfe624673a1417b772c7ced

  • SHA512

    84c0ffdf5c93f716be2c93a24182f4f7ed2cc26090bb20c6282890790a49d3e4184861ce33c90a60b8c816676c1a1bfee44e1bb4a72eec9536de53617622cd2c

  • SSDEEP

    12288:73+OpWxq7pksFB24lA87g7/VycgE81lgxaa79y:73AihPBoIlg17o

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e2fb40bb71146cf53cca03b4323f7c449c3de67aacfe624673a1417b772c7ced

    • Size

      790KB

    • MD5

      eef10bd401bfdae5030b22f8d75e63bf

    • SHA1

      0b5540ccfe1e9f385c36b96b1ac2fd7e48ed6f91

    • SHA256

      e2fb40bb71146cf53cca03b4323f7c449c3de67aacfe624673a1417b772c7ced

    • SHA512

      84c0ffdf5c93f716be2c93a24182f4f7ed2cc26090bb20c6282890790a49d3e4184861ce33c90a60b8c816676c1a1bfee44e1bb4a72eec9536de53617622cd2c

    • SSDEEP

      12288:73+OpWxq7pksFB24lA87g7/VycgE81lgxaa79y:73AihPBoIlg17o

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks