Overview

overview

10

Static

static

3

ebae32604b...e1.exe

windows7-x64

10

ebae32604b...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebae32604bec7b119a1b37913a139a1933b7453ce3d5a6e26f4b99244e5d04e1

  • Size

    90KB

  • Sample

    241223-eyfjeswlcp

  • MD5

    bf7975aa759e4b909d984c52bd79d916

  • SHA1

    08dac539212ec4b7e4a70ddc36899995d2d60bda

  • SHA256

    ebae32604bec7b119a1b37913a139a1933b7453ce3d5a6e26f4b99244e5d04e1

  • SHA512

    91b1cd1ed5b0728cd894fc1f28b7ca2d0c2ec62dba87ca8b96ce66714bf11d5b5ce2c4fccf75fe00cc15878bd02d0aa59caf3822d73e21ad9fc91cda50f7dd38

  • SSDEEP

    1536:8EDzcmysReZ3MJ4at8tN5cHb5ZXztDcIkEtW6rxzavQ4SAIlzGju/Ub0VkVNK:1vRcMKat8tN5W5DIKW6t+vKlGju/Ub05

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      ebae32604bec7b119a1b37913a139a1933b7453ce3d5a6e26f4b99244e5d04e1

    • Size

      90KB

    • MD5

      bf7975aa759e4b909d984c52bd79d916

    • SHA1

      08dac539212ec4b7e4a70ddc36899995d2d60bda

    • SHA256

      ebae32604bec7b119a1b37913a139a1933b7453ce3d5a6e26f4b99244e5d04e1

    • SHA512

      91b1cd1ed5b0728cd894fc1f28b7ca2d0c2ec62dba87ca8b96ce66714bf11d5b5ce2c4fccf75fe00cc15878bd02d0aa59caf3822d73e21ad9fc91cda50f7dd38

    • SSDEEP

      1536:8EDzcmysReZ3MJ4at8tN5cHb5ZXztDcIkEtW6rxzavQ4SAIlzGju/Ub0VkVNK:1vRcMKat8tN5W5DIKW6t+vKlGju/Ub05

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks