Overview

overview

10

Static

static

3

9d3ff928f4...c4.exe

windows7-x64

10

9d3ff928f4...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d3ff928f49c64f20889bd4586ff58367b96d1ea491bf30785e855a03fb318c4

  • Size

    120KB

  • Sample

    241223-brz3pstlhq

  • MD5

    ace2ab64a72c562987c51cedb4043fa0

  • SHA1

    4a9c6171e466bbfb84ce033be9f5ede5ab8be572

  • SHA256

    9d3ff928f49c64f20889bd4586ff58367b96d1ea491bf30785e855a03fb318c4

  • SHA512

    3b7181190f08ab2b33f9cbdcffb7bfcbe42f159db550a17df00e0602ae63934a20067ea7d72d6f284689150aaf27f732086511201874867740d33ec6f14b355f

  • SSDEEP

    1536:R0hMXWBuWCKUY9m1oBQG5Fz1KqSjxVVR8k4wUe0M6zEjz0cZ44mjD9r823F4:5ljf+gqSNn4wH76Bi/mjRrz3C

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9d3ff928f49c64f20889bd4586ff58367b96d1ea491bf30785e855a03fb318c4

    • Size

      120KB

    • MD5

      ace2ab64a72c562987c51cedb4043fa0

    • SHA1

      4a9c6171e466bbfb84ce033be9f5ede5ab8be572

    • SHA256

      9d3ff928f49c64f20889bd4586ff58367b96d1ea491bf30785e855a03fb318c4

    • SHA512

      3b7181190f08ab2b33f9cbdcffb7bfcbe42f159db550a17df00e0602ae63934a20067ea7d72d6f284689150aaf27f732086511201874867740d33ec6f14b355f

    • SSDEEP

      1536:R0hMXWBuWCKUY9m1oBQG5Fz1KqSjxVVR8k4wUe0M6zEjz0cZ44mjD9r823F4:5ljf+gqSNn4wH76Bi/mjRrz3C

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks