Overview

overview

10

Static

static

3

fd21fc2514...9N.exe

windows7-x64

10

fd21fc2514...9N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd21fc25140d1efed0b0fc945f153e2bccfc4a419e1df5d9dcf24985fc144349N.exe

  • Size

    97KB

  • Sample

    241222-st1kpasnhn

  • MD5

    c2f50e058e0bcd739c6e09ab4b3bd600

  • SHA1

    69403281f15c5e0ff5ce121df1ac5dac11c56c9d

  • SHA256

    fd21fc25140d1efed0b0fc945f153e2bccfc4a419e1df5d9dcf24985fc144349

  • SHA512

    238c44757f3a37de885a2e7b3aa0ee97237f40a3224240bd9edcdc1f3fbd18266acdc6bf50cf54d6a70e9c67fb1712efca66c37523c883d745f648809d04a228

  • SSDEEP

    1536:bD/v/CPPLYaB4kdW4BrLwsF4LgNad6CKfKOOGRncva3vJXeYZ6:bPa2keiOgYdhKLRcvkJXeK6

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fd21fc25140d1efed0b0fc945f153e2bccfc4a419e1df5d9dcf24985fc144349N.exe

    • Size

      97KB

    • MD5

      c2f50e058e0bcd739c6e09ab4b3bd600

    • SHA1

      69403281f15c5e0ff5ce121df1ac5dac11c56c9d

    • SHA256

      fd21fc25140d1efed0b0fc945f153e2bccfc4a419e1df5d9dcf24985fc144349

    • SHA512

      238c44757f3a37de885a2e7b3aa0ee97237f40a3224240bd9edcdc1f3fbd18266acdc6bf50cf54d6a70e9c67fb1712efca66c37523c883d745f648809d04a228

    • SSDEEP

      1536:bD/v/CPPLYaB4kdW4BrLwsF4LgNad6CKfKOOGRncva3vJXeYZ6:bPa2keiOgYdhKLRcvkJXeK6

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks