Overview

overview

10

Static

static

3

611e489305...eN.exe

windows7-x64

10

611e489305...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    611e489305f2060a6c7d88e5c27a65ff93750ed50834f51efc1a7432a815dbdeN.exe

  • Size

    295KB

  • Sample

    241222-g73fnaxlhw

  • MD5

    9dc9e0e0a89e0998648a861ba601e210

  • SHA1

    f752379096ca7cc1b28adaf8fb9e89185dea9302

  • SHA256

    611e489305f2060a6c7d88e5c27a65ff93750ed50834f51efc1a7432a815dbde

  • SHA512

    72f9efc50d645b6be26c52a10d417b3512ef0ec62ba96f89e8295bf75fca5f6d2a2b28ed976358da896c4fa92b8309a3002ef2a8df21b835b49a67ecc6906aaa

  • SSDEEP

    3072:9zvlzEsvEI8kZKIf5/vtQ1hN5FxdJVBtZlR9pN5FxdgcwUqkY8Q0oMgE4cwUIsAL:IIZp5/TmZ1PY1PRe19V+tbFOLM77OLY

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      611e489305f2060a6c7d88e5c27a65ff93750ed50834f51efc1a7432a815dbdeN.exe

    • Size

      295KB

    • MD5

      9dc9e0e0a89e0998648a861ba601e210

    • SHA1

      f752379096ca7cc1b28adaf8fb9e89185dea9302

    • SHA256

      611e489305f2060a6c7d88e5c27a65ff93750ed50834f51efc1a7432a815dbde

    • SHA512

      72f9efc50d645b6be26c52a10d417b3512ef0ec62ba96f89e8295bf75fca5f6d2a2b28ed976358da896c4fa92b8309a3002ef2a8df21b835b49a67ecc6906aaa

    • SSDEEP

      3072:9zvlzEsvEI8kZKIf5/vtQ1hN5FxdJVBtZlR9pN5FxdgcwUqkY8Q0oMgE4cwUIsAL:IIZp5/TmZ1PY1PRe19V+tbFOLM77OLY

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks