Overview

overview

10

Static

static

10

2bda9c9923...3c.exe

windows7-x64

10

2bda9c9923...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2bda9c99230373fe928269d70f03e18a76c7a4e68c5386f6d99e9ff503a2ea3c

  • Size

    187KB

  • Sample

    241224-zkklfaxjgy

  • MD5

    f57e18ea485aa59f04daa7018d518126

  • SHA1

    dbe87934f0f2c60fa6c9e379954055d506df461b

  • SHA256

    2bda9c99230373fe928269d70f03e18a76c7a4e68c5386f6d99e9ff503a2ea3c

  • SHA512

    8af3c1ca42b780d1b50000e9836b23dad9da9bc18d9097356efb339815a921d807647d9d3961e06d46798ce2c7fc233c8e270654c64e4ba841fdc2e92f4d3d78

  • SSDEEP

    3072:X1nmFgbvApactRbMP7s7BFVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueHO:X1neJbE7yBFV+tbFOLM77OLLtu

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2bda9c99230373fe928269d70f03e18a76c7a4e68c5386f6d99e9ff503a2ea3c

    • Size

      187KB

    • MD5

      f57e18ea485aa59f04daa7018d518126

    • SHA1

      dbe87934f0f2c60fa6c9e379954055d506df461b

    • SHA256

      2bda9c99230373fe928269d70f03e18a76c7a4e68c5386f6d99e9ff503a2ea3c

    • SHA512

      8af3c1ca42b780d1b50000e9836b23dad9da9bc18d9097356efb339815a921d807647d9d3961e06d46798ce2c7fc233c8e270654c64e4ba841fdc2e92f4d3d78

    • SSDEEP

      3072:X1nmFgbvApactRbMP7s7BFVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueHO:X1neJbE7yBFV+tbFOLM77OLLtu

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks