Overview

overview

10

Static

static

3

a371785620...8d.exe

windows7-x64

10

a371785620...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a371785620bc883213827d447944fdbafcca504bf8573f06e61242eb637ce88d

  • Size

    99KB

  • Sample

    241225-bnb7gasrbx

  • MD5

    d096214d7bd228970098e2e131d6fca8

  • SHA1

    968e2bb4c08b58d18cf41a85a5a04ca8660ac36a

  • SHA256

    a371785620bc883213827d447944fdbafcca504bf8573f06e61242eb637ce88d

  • SHA512

    d5b69f79189636a0137dd080dfb9b9a7824b6b5452170e898403e79e76d0d7bd4b714232b63b76929410a5f5a3580549cce7714449b8cc59d2f054a5f05d12d1

  • SSDEEP

    1536:IUJpCHmjD+G/PAL7voCG8wxW7zyYC6OAoKL7oZjU6wBSs2FgblQQa3+om13XRzG:IwpCHmjDhi7v+KlJQgb3a3+X13XRzG

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a371785620bc883213827d447944fdbafcca504bf8573f06e61242eb637ce88d

    • Size

      99KB

    • MD5

      d096214d7bd228970098e2e131d6fca8

    • SHA1

      968e2bb4c08b58d18cf41a85a5a04ca8660ac36a

    • SHA256

      a371785620bc883213827d447944fdbafcca504bf8573f06e61242eb637ce88d

    • SHA512

      d5b69f79189636a0137dd080dfb9b9a7824b6b5452170e898403e79e76d0d7bd4b714232b63b76929410a5f5a3580549cce7714449b8cc59d2f054a5f05d12d1

    • SSDEEP

      1536:IUJpCHmjD+G/PAL7voCG8wxW7zyYC6OAoKL7oZjU6wBSs2FgblQQa3+om13XRzG:IwpCHmjDhi7v+KlJQgb3a3+X13XRzG

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks