Overview

overview

10

Static

static

3

9ba6588cc9...9a.exe

windows7-x64

10

9ba6588cc9...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ba6588cc93c49945803b7b77c9b186c9bf613dc6afe5a425f2ce96f4ce7009a

  • Size

    88KB

  • Sample

    241223-3wl57avqft

  • MD5

    54b94d06a83c5c52ce28b38d71022c7a

  • SHA1

    b1dd1251bd744b9e1c14d668f7ae736bc36770c3

  • SHA256

    9ba6588cc93c49945803b7b77c9b186c9bf613dc6afe5a425f2ce96f4ce7009a

  • SHA512

    811de1e5a82674218e0574912d09c7306c58a85276729fa53a8840ec718ae30c7e35c6e09413ae08cc2ff9e24a6e8f6099b322869389305991b097e2fa5da9d8

  • SSDEEP

    1536:rH0c9ochozxgA3xjgCa6ScY9S/ylgZ57oht8Enouy8h:rH0jxzSA3xI6SLS6ly1os0outh

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9ba6588cc93c49945803b7b77c9b186c9bf613dc6afe5a425f2ce96f4ce7009a

    • Size

      88KB

    • MD5

      54b94d06a83c5c52ce28b38d71022c7a

    • SHA1

      b1dd1251bd744b9e1c14d668f7ae736bc36770c3

    • SHA256

      9ba6588cc93c49945803b7b77c9b186c9bf613dc6afe5a425f2ce96f4ce7009a

    • SHA512

      811de1e5a82674218e0574912d09c7306c58a85276729fa53a8840ec718ae30c7e35c6e09413ae08cc2ff9e24a6e8f6099b322869389305991b097e2fa5da9d8

    • SSDEEP

      1536:rH0c9ochozxgA3xjgCa6ScY9S/ylgZ57oht8Enouy8h:rH0jxzSA3xI6SLS6ly1os0outh

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks