Overview

overview

10

Static

static

10

a4e378a408...aN.exe

windows7-x64

10

a4e378a408...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4e378a4082f2b1d715156df3119354894ad5bfcd04b9ea809bf1421146bd41aN.exe

  • Size

    136KB

  • Sample

    241222-j5xthazrbx

  • MD5

    40f7cb9ad957615029ea066c073ee690

  • SHA1

    0734695d6616838d371ea5c48d7ebad041933a2a

  • SHA256

    a4e378a4082f2b1d715156df3119354894ad5bfcd04b9ea809bf1421146bd41a

  • SHA512

    80af1426f677fe21927dc61e179ad88d5c3ca503d14f91ec9724d540077ff0088d0f07c167612aa1fd9e6f0b962063f233f029a66f8207d938def1d68932357a

  • SSDEEP

    1536:okCB9kd8AjA2M3SDcGWjIHcCZc5mz8+QquozVV/ljz0cZ44mjD9r823FQ75/DtXh:oFBj8xtDcGWucwNAIzVt6i/mjRrz3OT

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a4e378a4082f2b1d715156df3119354894ad5bfcd04b9ea809bf1421146bd41aN.exe

    • Size

      136KB

    • MD5

      40f7cb9ad957615029ea066c073ee690

    • SHA1

      0734695d6616838d371ea5c48d7ebad041933a2a

    • SHA256

      a4e378a4082f2b1d715156df3119354894ad5bfcd04b9ea809bf1421146bd41a

    • SHA512

      80af1426f677fe21927dc61e179ad88d5c3ca503d14f91ec9724d540077ff0088d0f07c167612aa1fd9e6f0b962063f233f029a66f8207d938def1d68932357a

    • SSDEEP

      1536:okCB9kd8AjA2M3SDcGWjIHcCZc5mz8+QquozVV/ljz0cZ44mjD9r823FQ75/DtXh:oFBj8xtDcGWucwNAIzVt6i/mjRrz3OT

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks