Overview

overview

10

Static

static

3

e619b8144a...fa.exe

windows7-x64

10

e619b8144a...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e619b8144a2616a963962442f6917515650b740d6b93767b59a285e905cd24fa

  • Size

    90KB

  • Sample

    241223-ep6z1swjcv

  • MD5

    0f9eebf861111b8ef7cc0a03befc561b

  • SHA1

    9a9c5f93ef3f90cf9949625238005154181507ee

  • SHA256

    e619b8144a2616a963962442f6917515650b740d6b93767b59a285e905cd24fa

  • SHA512

    ad10f84f6f49899dc00bffc4e61587a5a0da11a6d4cac7384a473b4d6b028608c61ab4001138e43594ef541c3ba8fec93a136f83c3b1996882e5ca4caea31fa9

  • SSDEEP

    1536:j/0kkZnWGM4R/6oHUZmwKthSSNEgBx0sl9XL7XnYGlu/Ub0VkVNK:jnk1eop0gBx0SBYGlu/Ub0+NK

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e619b8144a2616a963962442f6917515650b740d6b93767b59a285e905cd24fa

    • Size

      90KB

    • MD5

      0f9eebf861111b8ef7cc0a03befc561b

    • SHA1

      9a9c5f93ef3f90cf9949625238005154181507ee

    • SHA256

      e619b8144a2616a963962442f6917515650b740d6b93767b59a285e905cd24fa

    • SHA512

      ad10f84f6f49899dc00bffc4e61587a5a0da11a6d4cac7384a473b4d6b028608c61ab4001138e43594ef541c3ba8fec93a136f83c3b1996882e5ca4caea31fa9

    • SSDEEP

      1536:j/0kkZnWGM4R/6oHUZmwKthSSNEgBx0sl9XL7XnYGlu/Ub0VkVNK:jnk1eop0gBx0SBYGlu/Ub0+NK

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks