Overview

overview

10

Static

static

3

520e0ed458...3a.exe

windows7-x64

10

520e0ed458...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    520e0ed458581e44cd9a1cba5f1ba3d09ae46827b09471a7411d693cb7557a3a.exe

  • Size

    470KB

  • Sample

    241222-r2sdls1nat

  • MD5

    1af1ec33b59a36a1d60b2d00e6c5132d

  • SHA1

    3ca8d2ca24d1a7b76f6e8fe53a73530cfd277dd0

  • SHA256

    520e0ed458581e44cd9a1cba5f1ba3d09ae46827b09471a7411d693cb7557a3a

  • SHA512

    ca750bab5627934836f7aa47faa7404e84d2d2ab45922e0ccf1c60fd76cea908473d433b1cd7f0fe4aa9a79ced63b4fe4b5f48add5b48c77b86bb225c64399fb

  • SSDEEP

    12288:Bt85+C/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8Qk:785+C4O

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      520e0ed458581e44cd9a1cba5f1ba3d09ae46827b09471a7411d693cb7557a3a.exe

    • Size

      470KB

    • MD5

      1af1ec33b59a36a1d60b2d00e6c5132d

    • SHA1

      3ca8d2ca24d1a7b76f6e8fe53a73530cfd277dd0

    • SHA256

      520e0ed458581e44cd9a1cba5f1ba3d09ae46827b09471a7411d693cb7557a3a

    • SHA512

      ca750bab5627934836f7aa47faa7404e84d2d2ab45922e0ccf1c60fd76cea908473d433b1cd7f0fe4aa9a79ced63b4fe4b5f48add5b48c77b86bb225c64399fb

    • SSDEEP

      12288:Bt85+C/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8Qk:785+C4O

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks