Overview

overview

10

Static

static

3

05ba85efcd...56.exe

windows7-x64

10

05ba85efcd...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05ba85efcd8bb704367729577a56dd02817c0164c9ccbd4795c2c1d60c79b456

  • Size

    1.3MB

  • Sample

    241224-xxy89avjh1

  • MD5

    d7d0575cdd6bc1914369edd781d2bf56

  • SHA1

    52210036d42265bd56b4163b297ff81be012021a

  • SHA256

    05ba85efcd8bb704367729577a56dd02817c0164c9ccbd4795c2c1d60c79b456

  • SHA512

    e6d3d3ca75b58437f85072fcc01a61ffc5a444b7fc92b10efd06082d4c82b02669eecd24a367d03c25a175461c6a11fd877ac728641dfed5b132a6ee59204a8e

  • SSDEEP

    6144:k5cbT8OXE5ZC2npb+oB+Zz2HG8t0DoEWufVuvw0HBHY8rQ+6bPD3wPSk8ymL2MTb:BAbaz22cWfVaw0HBHY8r8ABjMn

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      05ba85efcd8bb704367729577a56dd02817c0164c9ccbd4795c2c1d60c79b456

    • Size

      1.3MB

    • MD5

      d7d0575cdd6bc1914369edd781d2bf56

    • SHA1

      52210036d42265bd56b4163b297ff81be012021a

    • SHA256

      05ba85efcd8bb704367729577a56dd02817c0164c9ccbd4795c2c1d60c79b456

    • SHA512

      e6d3d3ca75b58437f85072fcc01a61ffc5a444b7fc92b10efd06082d4c82b02669eecd24a367d03c25a175461c6a11fd877ac728641dfed5b132a6ee59204a8e

    • SSDEEP

      6144:k5cbT8OXE5ZC2npb+oB+Zz2HG8t0DoEWufVuvw0HBHY8rQ+6bPD3wPSk8ymL2MTb:BAbaz22cWfVaw0HBHY8r8ABjMn

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks