berbew | 3560440702f4261c6f32b36cd0d332113bdbd3e34383c5f4240af7b2345500c4 | Triage

Sharing

General

Target

3560440702f4261c6f32b36cd0d332113bdbd3e34383c5f4240af7b2345500c4N.exe
Size

482KB
Sample

241225-tabynaxnfr
MD5

ee361203ea27207d2a1bd7ce0481ae50
SHA1

79307aeeeb7bb948e37bc9c76a573af3facb62dd
SHA256

3560440702f4261c6f32b36cd0d332113bdbd3e34383c5f4240af7b2345500c4
SHA512

bf53b1e5c8c354038e474d64c2d565f607e7e390fdea2052285af24a006ca43d45bc41149e3718340d77b1510023b6128a720d00b45ab0e1c465c4c113a4ce8a
SSDEEP

6144:6yAJi0nLLl+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3y:kJZLMwGXAF5KLVGFB24lwR45FB24lg

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

- Target
  
  3560440702f4261c6f32b36cd0d332113bdbd3e34383c5f4240af7b2345500c4N.exe
- Size
  
  482KB
- MD5
  
  ee361203ea27207d2a1bd7ce0481ae50
- SHA1
  
  79307aeeeb7bb948e37bc9c76a573af3facb62dd
- SHA256
  
  3560440702f4261c6f32b36cd0d332113bdbd3e34383c5f4240af7b2345500c4
- SHA512
  
  bf53b1e5c8c354038e474d64c2d565f607e7e390fdea2052285af24a006ca43d45bc41149e3718340d77b1510023b6128a720d00b45ab0e1c465c4c113a4ce8a
- SSDEEP
  
  6144:6yAJi0nLLl+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3y:kJZLMwGXAF5KLVGFB24lwR45FB24lg
Score

10^/10

berbew backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbackdoordiscoverypersistence

behavioral2

berbewbackdoordiscoverypersistence