Overview

overview

10

Static

static

3

dc521eaf6b...fc.exe

windows7-x64

10

dc521eaf6b...fc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc521eaf6ba019d2408798fd51f448ef4c4fd2b22b09a7f24daa83546a5f18fc

  • Size

    91KB

  • Sample

    241225-dyfczswmh1

  • MD5

    e58582557367b03047d9c6fa3ad94971

  • SHA1

    eb1df50adac369a1fb60d8ca9a99b8eedd2fc9fc

  • SHA256

    dc521eaf6ba019d2408798fd51f448ef4c4fd2b22b09a7f24daa83546a5f18fc

  • SHA512

    b0b3d7fe402fc96f79960ae81b942cdc91f5d830378db6d351ded037ddad3f2b4bddd8e9b9e6b2eeb55b088210e67010fd2ae9fa5fe121dbb45223b8e34bba2c

  • SSDEEP

    1536:sDND1BSmU9gwphXUBPcUbqC8S6sm0ktVXvFYr/viVMi:sDNBbQNpUPJ8S61fto/vOMi

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      dc521eaf6ba019d2408798fd51f448ef4c4fd2b22b09a7f24daa83546a5f18fc

    • Size

      91KB

    • MD5

      e58582557367b03047d9c6fa3ad94971

    • SHA1

      eb1df50adac369a1fb60d8ca9a99b8eedd2fc9fc

    • SHA256

      dc521eaf6ba019d2408798fd51f448ef4c4fd2b22b09a7f24daa83546a5f18fc

    • SHA512

      b0b3d7fe402fc96f79960ae81b942cdc91f5d830378db6d351ded037ddad3f2b4bddd8e9b9e6b2eeb55b088210e67010fd2ae9fa5fe121dbb45223b8e34bba2c

    • SSDEEP

      1536:sDND1BSmU9gwphXUBPcUbqC8S6sm0ktVXvFYr/viVMi:sDNBbQNpUPJ8S61fto/vOMi

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks