Overview

overview

10

Static

static

3

e4d84197d6...58.exe

windows7-x64

10

e4d84197d6...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4d84197d67384c54e67090862f1866fcd93df40d2d6c40d3d0cc95c11c60a58

  • Size

    96KB

  • Sample

    241225-ead1pawrcz

  • MD5

    ba2bf5eae6764cb59278230e6a79cd37

  • SHA1

    c796fdf87408c7b752162b1114ccb1d1f1689625

  • SHA256

    e4d84197d67384c54e67090862f1866fcd93df40d2d6c40d3d0cc95c11c60a58

  • SHA512

    c96c66f285313ed9917d1c9db22d6b47af46ec036f6f5a46bbe54a9916fe57c8fcfc3df4bb0639a8adc09e3b38319e8b0373012a6c46a2bff20f098cbc3f3bc4

  • SSDEEP

    1536:0Vp11+RgWp9ocrQzQSbKTegfDZGk1/oVfV5hrUQVoMdUT+irF:gn+Gc9ocrQcSGTlbZ505hr1Rhk

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e4d84197d67384c54e67090862f1866fcd93df40d2d6c40d3d0cc95c11c60a58

    • Size

      96KB

    • MD5

      ba2bf5eae6764cb59278230e6a79cd37

    • SHA1

      c796fdf87408c7b752162b1114ccb1d1f1689625

    • SHA256

      e4d84197d67384c54e67090862f1866fcd93df40d2d6c40d3d0cc95c11c60a58

    • SHA512

      c96c66f285313ed9917d1c9db22d6b47af46ec036f6f5a46bbe54a9916fe57c8fcfc3df4bb0639a8adc09e3b38319e8b0373012a6c46a2bff20f098cbc3f3bc4

    • SSDEEP

      1536:0Vp11+RgWp9ocrQzQSbKTegfDZGk1/oVfV5hrUQVoMdUT+irF:gn+Gc9ocrQcSGTlbZ505hr1Rhk

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks