Overview

overview

10

Static

static

10

26c6df51f8...88.exe

windows7-x64

10

26c6df51f8...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26c6df51f8063818cf26e11d7da9ba2dbdd28dbbf9b38ba41ee5162cdbffc088.exe

  • Size

    362KB

  • Sample

    241225-thqf1sxqfn

  • MD5

    332219a0e94c3e3ee995bac97b5fbe08

  • SHA1

    880eabab811aeb9c4bc349d4b7b55118f389d1f8

  • SHA256

    26c6df51f8063818cf26e11d7da9ba2dbdd28dbbf9b38ba41ee5162cdbffc088

  • SHA512

    ce1983bcc2727d925382e2ba8946ca82cf36ea25f92ba26057a1bd37edcbb711334e2a7fe240be7a5ec83b44652538783839d9376e5dbb2fa3eeadb59f38fd5e

  • SSDEEP

    6144:5NAIPVbUh7x5MbCSiBXf0Rg72xfJ9aCzrwbo1pw00+qnrLYC/VuwkdbA4+D6ByqA:fRPtax+CcROhtYNY6ThtY/

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      26c6df51f8063818cf26e11d7da9ba2dbdd28dbbf9b38ba41ee5162cdbffc088.exe

    • Size

      362KB

    • MD5

      332219a0e94c3e3ee995bac97b5fbe08

    • SHA1

      880eabab811aeb9c4bc349d4b7b55118f389d1f8

    • SHA256

      26c6df51f8063818cf26e11d7da9ba2dbdd28dbbf9b38ba41ee5162cdbffc088

    • SHA512

      ce1983bcc2727d925382e2ba8946ca82cf36ea25f92ba26057a1bd37edcbb711334e2a7fe240be7a5ec83b44652538783839d9376e5dbb2fa3eeadb59f38fd5e

    • SSDEEP

      6144:5NAIPVbUh7x5MbCSiBXf0Rg72xfJ9aCzrwbo1pw00+qnrLYC/VuwkdbA4+D6ByqA:fRPtax+CcROhtYNY6ThtY/

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks