Overview

overview

10

Static

static

10

9581b30fd4...eb.exe

windows7-x64

10

9581b30fd4...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9581b30fd412ab1df97ba718da8a5be61e5c64a90b72a81b3bfcf5072a09e0eb

  • Size

    305KB

  • Sample

    241225-a3rp2aslc1

  • MD5

    bce324a271cb9886d1b1636aa0019d7b

  • SHA1

    b2cf8adc3e3a2c36aa665f757a500d3ab18b6005

  • SHA256

    9581b30fd412ab1df97ba718da8a5be61e5c64a90b72a81b3bfcf5072a09e0eb

  • SHA512

    5ecc1fe700718f0b4d868c228b2be3b86ff08ee62db14cb43419421b8f0047665b4ef118ccbec407e937d5164c5f1a33fb3b37c0490a61018e9083d1fb98ba02

  • SSDEEP

    3072:1cvZuAU97V8hNOr+lc802eS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQVDb0668:1cE9+OClc85dZMGXF5ahdt3b0668

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9581b30fd412ab1df97ba718da8a5be61e5c64a90b72a81b3bfcf5072a09e0eb

    • Size

      305KB

    • MD5

      bce324a271cb9886d1b1636aa0019d7b

    • SHA1

      b2cf8adc3e3a2c36aa665f757a500d3ab18b6005

    • SHA256

      9581b30fd412ab1df97ba718da8a5be61e5c64a90b72a81b3bfcf5072a09e0eb

    • SHA512

      5ecc1fe700718f0b4d868c228b2be3b86ff08ee62db14cb43419421b8f0047665b4ef118ccbec407e937d5164c5f1a33fb3b37c0490a61018e9083d1fb98ba02

    • SSDEEP

      3072:1cvZuAU97V8hNOr+lc802eS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQVDb0668:1cE9+OClc85dZMGXF5ahdt3b0668

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks