Overview

overview

10

Static

static

3

272df20242...d9.exe

windows7-x64

10

272df20242...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    272df20242aedac380d13b9389a999822a19858ab6e4e222ba56c4ae2a1cb3d9.exe

  • Size

    72KB

  • Sample

    241225-1brttsyjhw

  • MD5

    9c9d5573f76e562082d04ac7f595af96

  • SHA1

    e6a242db766c0307f2fea5d04775d73c315ef09b

  • SHA256

    272df20242aedac380d13b9389a999822a19858ab6e4e222ba56c4ae2a1cb3d9

  • SHA512

    a055abaa7c0eae33446e05e77cb70b2070a2aae8ffec0775445a1e62137cdebe5aa51a66c031d661eadd4a74f42e4c08760a974865c4ba87cccb3a65d8f24942

  • SSDEEP

    768:gXZoIaIdNrmRjdl/tVmCJQUgJzry0K4j4lEX0rPNWCAYhQE25ScJA2YOw+LDgGoF:gXZo3+B+/u4uFdK4kekkENXdhATgV5NT

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      272df20242aedac380d13b9389a999822a19858ab6e4e222ba56c4ae2a1cb3d9.exe

    • Size

      72KB

    • MD5

      9c9d5573f76e562082d04ac7f595af96

    • SHA1

      e6a242db766c0307f2fea5d04775d73c315ef09b

    • SHA256

      272df20242aedac380d13b9389a999822a19858ab6e4e222ba56c4ae2a1cb3d9

    • SHA512

      a055abaa7c0eae33446e05e77cb70b2070a2aae8ffec0775445a1e62137cdebe5aa51a66c031d661eadd4a74f42e4c08760a974865c4ba87cccb3a65d8f24942

    • SSDEEP

      768:gXZoIaIdNrmRjdl/tVmCJQUgJzry0K4j4lEX0rPNWCAYhQE25ScJA2YOw+LDgGoF:gXZo3+B+/u4uFdK4kekkENXdhATgV5NT

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks