Overview

overview

10

Static

static

3

c9c899cb94...03.exe

windows7-x64

10

c9c899cb94...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9c899cb94211765367ae4ca1184ff5451b1567663d971f117d99b61cc3db403

  • Size

    96KB

  • Sample

    241210-bdymqaxqbt

  • MD5

    2d22f81c6008989a4a97a6e4a321b115

  • SHA1

    7368c3213174f48dbf25544029c022cf82890fbc

  • SHA256

    c9c899cb94211765367ae4ca1184ff5451b1567663d971f117d99b61cc3db403

  • SHA512

    dd027ac5594300cc35d9c773dc6009113253ed7b32b17d638fe90a161882ddf49d38d0dec0777426ae65de661e487a3922ee3d6492308a9457b198441ba31b96

  • SSDEEP

    1536:4QAhDmLCyiYZi2o4NdqOAngwmJGRF6ZOJhTIpIRpduV9jojTIvjrH:XuDmLhi8i2ourZwmJGRF/TEUpd69jc0X

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c9c899cb94211765367ae4ca1184ff5451b1567663d971f117d99b61cc3db403

    • Size

      96KB

    • MD5

      2d22f81c6008989a4a97a6e4a321b115

    • SHA1

      7368c3213174f48dbf25544029c022cf82890fbc

    • SHA256

      c9c899cb94211765367ae4ca1184ff5451b1567663d971f117d99b61cc3db403

    • SHA512

      dd027ac5594300cc35d9c773dc6009113253ed7b32b17d638fe90a161882ddf49d38d0dec0777426ae65de661e487a3922ee3d6492308a9457b198441ba31b96

    • SSDEEP

      1536:4QAhDmLCyiYZi2o4NdqOAngwmJGRF6ZOJhTIpIRpduV9jojTIvjrH:XuDmLhi8i2ourZwmJGRF/TEUpd69jc0X

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks