Overview

overview

10

Static

static

3

9a44218b2a...2N.exe

windows7-x64

10

9a44218b2a...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a44218b2ae0a19ba646984b44fb34834c0b042359b9fa4657c087e4757e0482N.exe

  • Size

    71KB

  • Sample

    241222-m1fafavphz

  • MD5

    f6991833608a193d4cf0bc7703622180

  • SHA1

    3d7c34b3aafe3a183d9bf83aedb0ca1794632d52

  • SHA256

    9a44218b2ae0a19ba646984b44fb34834c0b042359b9fa4657c087e4757e0482

  • SHA512

    23dcc1d91486798f1570b1fa9941e4448354ece6f4f7bdd58212e8669f2ba5a75cf591c00f434961ec750c0b0cf73b094d40c33ab724faa2dbb8dcd7ae19af62

  • SSDEEP

    1536:eZyWSuio/kKWqiBLSoAqgFqBuc0FCp02KgkjLDRQCK1P+ATT5:esWSMsKWqiBLTuGm2WLDeRP+A35

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9a44218b2ae0a19ba646984b44fb34834c0b042359b9fa4657c087e4757e0482N.exe

    • Size

      71KB

    • MD5

      f6991833608a193d4cf0bc7703622180

    • SHA1

      3d7c34b3aafe3a183d9bf83aedb0ca1794632d52

    • SHA256

      9a44218b2ae0a19ba646984b44fb34834c0b042359b9fa4657c087e4757e0482

    • SHA512

      23dcc1d91486798f1570b1fa9941e4448354ece6f4f7bdd58212e8669f2ba5a75cf591c00f434961ec750c0b0cf73b094d40c33ab724faa2dbb8dcd7ae19af62

    • SSDEEP

      1536:eZyWSuio/kKWqiBLSoAqgFqBuc0FCp02KgkjLDRQCK1P+ATT5:esWSMsKWqiBLTuGm2WLDeRP+A35

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks