Overview

overview

10

Static

static

3

b93b9e982d...01.exe

windows7-x64

10

b93b9e982d...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b93b9e982d35da5e5fedf74ca9c4011428d3e273ef3802d8179c4f897d564101.exe

  • Size

    74KB

  • Sample

    241225-s5fdwsxjes

  • MD5

    6d5d8902240415abf13917447ced80de

  • SHA1

    59231e882b1659131f1e6e82cfd72d2084cdd849

  • SHA256

    b93b9e982d35da5e5fedf74ca9c4011428d3e273ef3802d8179c4f897d564101

  • SHA512

    d9504281bb54a1a0334ebbbd34ff6f277762674927dfb057c4d52a7af4f8bf34685569b24f67d333c85c7eed1e63515ec06a12118d61b382f33bff3890cbfcdb

  • SSDEEP

    1536:MKs1VmcmOXjMN5QsIXn0Ab8vCGa89lqZ6rYM7KrxkxK2xVmJEyhnIOW:M/XmOXjVDn09rqZ6MMtyNW

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b93b9e982d35da5e5fedf74ca9c4011428d3e273ef3802d8179c4f897d564101.exe

    • Size

      74KB

    • MD5

      6d5d8902240415abf13917447ced80de

    • SHA1

      59231e882b1659131f1e6e82cfd72d2084cdd849

    • SHA256

      b93b9e982d35da5e5fedf74ca9c4011428d3e273ef3802d8179c4f897d564101

    • SHA512

      d9504281bb54a1a0334ebbbd34ff6f277762674927dfb057c4d52a7af4f8bf34685569b24f67d333c85c7eed1e63515ec06a12118d61b382f33bff3890cbfcdb

    • SSDEEP

      1536:MKs1VmcmOXjMN5QsIXn0Ab8vCGa89lqZ6rYM7KrxkxK2xVmJEyhnIOW:M/XmOXjVDn09rqZ6MMtyNW

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks