Overview

overview

10

Static

static

3

67bb635c0e...01.exe

windows7-x64

10

67bb635c0e...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67bb635c0ef3013c435bbff9a8e81f54f0024d697812b5d300b68ede6e2c6801

  • Size

    74KB

  • Sample

    241223-1xg7hssral

  • MD5

    b40be29d508262d7a8c8dba85400bbf7

  • SHA1

    95c73af2d92bbbcfe1385a6df031e6ed141a5ace

  • SHA256

    67bb635c0ef3013c435bbff9a8e81f54f0024d697812b5d300b68ede6e2c6801

  • SHA512

    96937b2415a136cef8655f454e6c2ec75fbe1231c75a6d198f952233d942a83e913c62483a83fab3c3101b84609d8678f18dad09905c94a69d3fe820bf586682

  • SSDEEP

    1536:lsSDtQThxsOqUynOnze/i/1CpkVXmNPXplxBi:lsSchWUynQSDk5sXu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      67bb635c0ef3013c435bbff9a8e81f54f0024d697812b5d300b68ede6e2c6801

    • Size

      74KB

    • MD5

      b40be29d508262d7a8c8dba85400bbf7

    • SHA1

      95c73af2d92bbbcfe1385a6df031e6ed141a5ace

    • SHA256

      67bb635c0ef3013c435bbff9a8e81f54f0024d697812b5d300b68ede6e2c6801

    • SHA512

      96937b2415a136cef8655f454e6c2ec75fbe1231c75a6d198f952233d942a83e913c62483a83fab3c3101b84609d8678f18dad09905c94a69d3fe820bf586682

    • SSDEEP

      1536:lsSDtQThxsOqUynOnze/i/1CpkVXmNPXplxBi:lsSchWUynQSDk5sXu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks