Overview

overview

10

Static

static

3

f289b2cd4f...33.exe

windows7-x64

10

f289b2cd4f...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f289b2cd4f0c878cb8fed6fb5ddde28aa72b529a36eb728d7359ba0ca7fb9e33

  • Size

    844KB

  • Sample

    241210-cre8zaznfw

  • MD5

    c8398e75758939f7b25a19aec0b452ee

  • SHA1

    6ce083b93eb995a9a77d413f902f5f8e3984eb1d

  • SHA256

    f289b2cd4f0c878cb8fed6fb5ddde28aa72b529a36eb728d7359ba0ca7fb9e33

  • SHA512

    72ddfe7bb88dce3616f9dd49ab69873f74e0804458599f100717aba140d50174d4be422d841376bd689636ada489c290babb568e97efedd5fd54cb0c8fe2f42c

  • SSDEEP

    24576:VnzHdH5W3Tnbc53cp6p5vihMpQnqrdX72LbY:fH5W3TbGBihw+cdX

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f289b2cd4f0c878cb8fed6fb5ddde28aa72b529a36eb728d7359ba0ca7fb9e33

    • Size

      844KB

    • MD5

      c8398e75758939f7b25a19aec0b452ee

    • SHA1

      6ce083b93eb995a9a77d413f902f5f8e3984eb1d

    • SHA256

      f289b2cd4f0c878cb8fed6fb5ddde28aa72b529a36eb728d7359ba0ca7fb9e33

    • SHA512

      72ddfe7bb88dce3616f9dd49ab69873f74e0804458599f100717aba140d50174d4be422d841376bd689636ada489c290babb568e97efedd5fd54cb0c8fe2f42c

    • SSDEEP

      24576:VnzHdH5W3Tnbc53cp6p5vihMpQnqrdX72LbY:fH5W3TbGBihw+cdX

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks