Overview

overview

10

Static

static

10

0a02847455...4a.exe

windows7-x64

10

0a02847455...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a0284745597e5d4959da513a230b32dd4c2dc61b2496388662e1aa5421d474a

  • Size

    169KB

  • Sample

    241224-x4994avlfv

  • MD5

    beacbb744b0a3c189c7d696fe4f11401

  • SHA1

    48f18c470ffaa9b7ba81c2c069f442b20d1ee846

  • SHA256

    0a0284745597e5d4959da513a230b32dd4c2dc61b2496388662e1aa5421d474a

  • SHA512

    3432e32b95612d68f1abc43f0aff4988f576e4d8bc4dc3e4ac519b6c559a6be2c4f90e6191ba7cd8b2b4601d495c88949ac13929717f2f948ef7ff5a0af40b28

  • SSDEEP

    3072:5DuS1ORCIYYKNPxMeEvPOdgujv6NLPfFFrKP92f65Ha:4S1SRYYKNJML3OdgawrFZKPf9

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0a0284745597e5d4959da513a230b32dd4c2dc61b2496388662e1aa5421d474a

    • Size

      169KB

    • MD5

      beacbb744b0a3c189c7d696fe4f11401

    • SHA1

      48f18c470ffaa9b7ba81c2c069f442b20d1ee846

    • SHA256

      0a0284745597e5d4959da513a230b32dd4c2dc61b2496388662e1aa5421d474a

    • SHA512

      3432e32b95612d68f1abc43f0aff4988f576e4d8bc4dc3e4ac519b6c559a6be2c4f90e6191ba7cd8b2b4601d495c88949ac13929717f2f948ef7ff5a0af40b28

    • SSDEEP

      3072:5DuS1ORCIYYKNPxMeEvPOdgujv6NLPfFFrKP92f65Ha:4S1SRYYKNJML3OdgawrFZKPf9

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks