Overview

overview

10

Static

static

10

4921326daa...89.exe

windows7-x64

10

4921326daa...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4921326daa800476a202e22ae9fedfe584ca08393b0d283a17e7d6f5ffab8d89

  • Size

    448KB

  • Sample

    241224-1pd5wsylep

  • MD5

    df3761820ebe09cc425e6467d789e91b

  • SHA1

    8d9b6d94d727299442c60022f2fae43fabfd458b

  • SHA256

    4921326daa800476a202e22ae9fedfe584ca08393b0d283a17e7d6f5ffab8d89

  • SHA512

    19d34b210b1c2468b247e9d1da1f73d75b0e3fa36b355a2fd83a9b3fae4c059cc84b9c2e3bec1c6331255d587a34a821635227a9e83ee38a23c3036429535095

  • SSDEEP

    6144:K+MLd47gVOn+9ZiLUmKyIxLDXXoq9FJZCUmKyIxL:t+W32XXf9Do3

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      4921326daa800476a202e22ae9fedfe584ca08393b0d283a17e7d6f5ffab8d89

    • Size

      448KB

    • MD5

      df3761820ebe09cc425e6467d789e91b

    • SHA1

      8d9b6d94d727299442c60022f2fae43fabfd458b

    • SHA256

      4921326daa800476a202e22ae9fedfe584ca08393b0d283a17e7d6f5ffab8d89

    • SHA512

      19d34b210b1c2468b247e9d1da1f73d75b0e3fa36b355a2fd83a9b3fae4c059cc84b9c2e3bec1c6331255d587a34a821635227a9e83ee38a23c3036429535095

    • SSDEEP

      6144:K+MLd47gVOn+9ZiLUmKyIxLDXXoq9FJZCUmKyIxL:t+W32XXf9Do3

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks