Overview

overview

10

Static

static

10

019feba6b8...a5.exe

windows7-x64

10

019feba6b8...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    019feba6b87dd594709694e43b85e20d44d88d6bb907eb05d06eeabecc726fa5.exe

  • Size

    448KB

  • Sample

    241225-scj7dawjgy

  • MD5

    24c8f606b9b405014d35f683c1b98763

  • SHA1

    02d456de5a39623451f486eaf333366c39919d7c

  • SHA256

    019feba6b87dd594709694e43b85e20d44d88d6bb907eb05d06eeabecc726fa5

  • SHA512

    274d183cab35d21e004e0963fb37bf900b351ff2dd2f63cf472896bf4fb913b5555c66f0cafdc8f0aab6e5ab68d9b7a332d98688d179b90e7daba3c1a9088e49

  • SSDEEP

    6144:0Dp17x8hsbxiLUmKyIxLDXXoq9FJZCUmKyIxL4:0Dx832XXf9Do35

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      019feba6b87dd594709694e43b85e20d44d88d6bb907eb05d06eeabecc726fa5.exe

    • Size

      448KB

    • MD5

      24c8f606b9b405014d35f683c1b98763

    • SHA1

      02d456de5a39623451f486eaf333366c39919d7c

    • SHA256

      019feba6b87dd594709694e43b85e20d44d88d6bb907eb05d06eeabecc726fa5

    • SHA512

      274d183cab35d21e004e0963fb37bf900b351ff2dd2f63cf472896bf4fb913b5555c66f0cafdc8f0aab6e5ab68d9b7a332d98688d179b90e7daba3c1a9088e49

    • SSDEEP

      6144:0Dp17x8hsbxiLUmKyIxLDXXoq9FJZCUmKyIxL4:0Dx832XXf9Do35

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks