Overview

overview

10

Static

static

10

5186a4b246...8f.exe

windows7-x64

10

5186a4b246...8f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5186a4b2463398efa2e21b39a7aa4811a93ce1cd557b51fc940725ca1b33058f.exe

  • Size

    217KB

  • Sample

    241225-tjcasaxnes

  • MD5

    487fee5b19b0874c23afc3bfc750cafe

  • SHA1

    602ad5801400a88e63b81f3832e0f34085fc4dc4

  • SHA256

    5186a4b2463398efa2e21b39a7aa4811a93ce1cd557b51fc940725ca1b33058f

  • SHA512

    3996beb3dc127e3e3412d4f2ef3c9f551b1e76acec8a0159624f7886809e8b34a496c06638c8ee64186ab7b3720244130a09933ebbe05a596cb4bd62dc6ae139

  • SSDEEP

    3072:IDC1MGepAgSuOarFAd0srUjgjGkeS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQX:I21nxgtO2AdTrXCkdZMGXF5ahdt3Z

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      5186a4b2463398efa2e21b39a7aa4811a93ce1cd557b51fc940725ca1b33058f.exe

    • Size

      217KB

    • MD5

      487fee5b19b0874c23afc3bfc750cafe

    • SHA1

      602ad5801400a88e63b81f3832e0f34085fc4dc4

    • SHA256

      5186a4b2463398efa2e21b39a7aa4811a93ce1cd557b51fc940725ca1b33058f

    • SHA512

      3996beb3dc127e3e3412d4f2ef3c9f551b1e76acec8a0159624f7886809e8b34a496c06638c8ee64186ab7b3720244130a09933ebbe05a596cb4bd62dc6ae139

    • SSDEEP

      3072:IDC1MGepAgSuOarFAd0srUjgjGkeS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQX:I21nxgtO2AdTrXCkdZMGXF5ahdt3Z

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks