Overview

overview

10

Static

static

3

75faf77617...dd.exe

windows7-x64

10

75faf77617...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75faf7761758d6c480135b389a9c63e1c0d8c5ed678128cab19bc6652440e9dd

  • Size

    90KB

  • Sample

    241222-3s9gbaslcm

  • MD5

    391ad69985535e7395eb6a4ef61d8faf

  • SHA1

    d835b5721b241441aff2df263fb1753d53fe9db6

  • SHA256

    75faf7761758d6c480135b389a9c63e1c0d8c5ed678128cab19bc6652440e9dd

  • SHA512

    9b1adb34f888841dc38d4bddd329073066ba9103625d1a544bbc19dcac1d7bcf0d5d7e329fd8828eb43cd1201746994dd031c6f250df337f0d38dff7a9c23ec4

  • SSDEEP

    1536:Lje6/Qy0S7u0utTYsLky9n24CijM1211ryNvw3XH2MfOOQ/4BrGTI5Yxj:Ljf8SIx1LkCn2FL1W12NY3X2AU/4kT0y

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      75faf7761758d6c480135b389a9c63e1c0d8c5ed678128cab19bc6652440e9dd

    • Size

      90KB

    • MD5

      391ad69985535e7395eb6a4ef61d8faf

    • SHA1

      d835b5721b241441aff2df263fb1753d53fe9db6

    • SHA256

      75faf7761758d6c480135b389a9c63e1c0d8c5ed678128cab19bc6652440e9dd

    • SHA512

      9b1adb34f888841dc38d4bddd329073066ba9103625d1a544bbc19dcac1d7bcf0d5d7e329fd8828eb43cd1201746994dd031c6f250df337f0d38dff7a9c23ec4

    • SSDEEP

      1536:Lje6/Qy0S7u0utTYsLky9n24CijM1211ryNvw3XH2MfOOQ/4BrGTI5Yxj:Ljf8SIx1LkCn2FL1W12NY3X2AU/4kT0y

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks