Overview

overview

10

Static

static

3

49be703d9d...9a.exe

windows7-x64

10

49be703d9d...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe

  • Size

    94KB

  • Sample

    241222-twkspatjfs

  • MD5

    3f99afd12dc366baab452986bbef5214

  • SHA1

    b6e56e9037d058bf42d1af5400d12e0df6260956

  • SHA256

    49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a

  • SHA512

    8dade7e0b9d2c60b8459e779f537e084f9badd7c133440a94d34479f297d9ffb81a1ec9eb0dfcdfaaeec2220c27483c525969458e208f4e83b9dd7a4c1df31cb

  • SSDEEP

    1536:OGCoDytavjNoaYwo1tnaI1wrGhb4rfhZ7hbx1v7BR9L4DT2EnINU:OGCk9BKwg/wrGObVv6+oJ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a.exe

    • Size

      94KB

    • MD5

      3f99afd12dc366baab452986bbef5214

    • SHA1

      b6e56e9037d058bf42d1af5400d12e0df6260956

    • SHA256

      49be703d9dfd33ee279ffeb245cff776bed5fdff39556b93ad0e2411bd51589a

    • SHA512

      8dade7e0b9d2c60b8459e779f537e084f9badd7c133440a94d34479f297d9ffb81a1ec9eb0dfcdfaaeec2220c27483c525969458e208f4e83b9dd7a4c1df31cb

    • SSDEEP

      1536:OGCoDytavjNoaYwo1tnaI1wrGhb4rfhZ7hbx1v7BR9L4DT2EnINU:OGCk9BKwg/wrGObVv6+oJ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks