Overview

overview

10

Static

static

3

95a22b3bf2...c5.exe

windows7-x64

10

95a22b3bf2...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95a22b3bf24f849e525101f6dfa875e8e99b8c66c421de2562b6f3dff42cb7c5

  • Size

    760KB

  • Sample

    241223-be85vasrbz

  • MD5

    eff1b4344f6c042e4473cbf6c2e69ecd

  • SHA1

    b8a08629dbb7a359f97039c1d9f5f74adc4c86c3

  • SHA256

    95a22b3bf24f849e525101f6dfa875e8e99b8c66c421de2562b6f3dff42cb7c5

  • SHA512

    1210944959a8e9857ac1c94e6fe4e1b77d4d6e38eba03927e0d197d39671b4f40b1e4f041a0b1286cfae1537b88c4c58dcdca25c0f146263d4219dc494f37aad

  • SSDEEP

    12288:S3WssP8Bb3cOK3NPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLx:huyNPh2kkkkK4kXkkkkkkkkhLx

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      95a22b3bf24f849e525101f6dfa875e8e99b8c66c421de2562b6f3dff42cb7c5

    • Size

      760KB

    • MD5

      eff1b4344f6c042e4473cbf6c2e69ecd

    • SHA1

      b8a08629dbb7a359f97039c1d9f5f74adc4c86c3

    • SHA256

      95a22b3bf24f849e525101f6dfa875e8e99b8c66c421de2562b6f3dff42cb7c5

    • SHA512

      1210944959a8e9857ac1c94e6fe4e1b77d4d6e38eba03927e0d197d39671b4f40b1e4f041a0b1286cfae1537b88c4c58dcdca25c0f146263d4219dc494f37aad

    • SSDEEP

      12288:S3WssP8Bb3cOK3NPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLx:huyNPh2kkkkK4kXkkkkkkkkhLx

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks