Overview

overview

10

Static

static

10

a773f2d445...30.exe

windows7-x64

10

a773f2d445...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a773f2d4457d8812d3ca315eba7413d9a37759dc3d9e2eeb6aeda110ac666830

  • Size

    276KB

  • Sample

    241225-bsnq3atkdq

  • MD5

    803a85ad7134e7223d5bb985928359e2

  • SHA1

    3c2cef6386228f6cbf6b9af4e0f5e9fa4da0a519

  • SHA256

    a773f2d4457d8812d3ca315eba7413d9a37759dc3d9e2eeb6aeda110ac666830

  • SHA512

    40e6a921d675d8b5f1eafc2333d4bfd19b5f8168daff1eed51008ec0e6e961b424b44676d5b59c41a5bfe15c065561c81e9ee72e9601211859dbf1f1fc5ec5dd

  • SSDEEP

    6144:vxk0YhPRZ4PdWZHEFJ7aWN1rtMsQBOSGaF+k:p6hJK2HEGWN1RMs1S7P

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a773f2d4457d8812d3ca315eba7413d9a37759dc3d9e2eeb6aeda110ac666830

    • Size

      276KB

    • MD5

      803a85ad7134e7223d5bb985928359e2

    • SHA1

      3c2cef6386228f6cbf6b9af4e0f5e9fa4da0a519

    • SHA256

      a773f2d4457d8812d3ca315eba7413d9a37759dc3d9e2eeb6aeda110ac666830

    • SHA512

      40e6a921d675d8b5f1eafc2333d4bfd19b5f8168daff1eed51008ec0e6e961b424b44676d5b59c41a5bfe15c065561c81e9ee72e9601211859dbf1f1fc5ec5dd

    • SSDEEP

      6144:vxk0YhPRZ4PdWZHEFJ7aWN1rtMsQBOSGaF+k:p6hJK2HEGWN1RMs1S7P

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks