Overview

overview

10

Static

static

3

15b3c43cb9...71.exe

windows7-x64

10

15b3c43cb9...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15b3c43cb92e72641cf2990409d0b7f65a5cf43217c7916688af62274419d071

  • Size

    844KB

  • Sample

    241224-ym23tswkhl

  • MD5

    fe2ea7bf2beec02bff59c89719702bd2

  • SHA1

    b455b50a1e30ea2f2eb27c9e3718c81c4d966219

  • SHA256

    15b3c43cb92e72641cf2990409d0b7f65a5cf43217c7916688af62274419d071

  • SHA512

    58783aaf6d641f18b25553de2025afd7f3f05d9a44f869b97753246a079e9c03618e1230da56f411e26655c7e99220e1263a3582450fc7d35c2166be5c158aa0

  • SSDEEP

    24576:NH5W3TnbQihMpQnqrdX72LbY6x46uR/qYglMi:NH5W3TbQihw+cdX2x46uhqllMi

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      15b3c43cb92e72641cf2990409d0b7f65a5cf43217c7916688af62274419d071

    • Size

      844KB

    • MD5

      fe2ea7bf2beec02bff59c89719702bd2

    • SHA1

      b455b50a1e30ea2f2eb27c9e3718c81c4d966219

    • SHA256

      15b3c43cb92e72641cf2990409d0b7f65a5cf43217c7916688af62274419d071

    • SHA512

      58783aaf6d641f18b25553de2025afd7f3f05d9a44f869b97753246a079e9c03618e1230da56f411e26655c7e99220e1263a3582450fc7d35c2166be5c158aa0

    • SSDEEP

      24576:NH5W3TnbQihMpQnqrdX72LbY6x46uR/qYglMi:NH5W3TbQihw+cdX2x46uhqllMi

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks