Overview

overview

10

Static

static

10

0e94e681cd...2N.exe

windows7-x64

10

0e94e681cd...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e94e681cd685a744d73431a7ed58b22481c930351750b08d14f0d395a8812c2N.exe

  • Size

    217KB

  • Sample

    241225-ttfqysykgm

  • MD5

    add6419916c257601857031c8aa441f0

  • SHA1

    215967c1b9ed5af7afc92842ddcc4cdf43732f07

  • SHA256

    0e94e681cd685a744d73431a7ed58b22481c930351750b08d14f0d395a8812c2

  • SHA512

    74030b702824c15add175a076c2bf2c9c8e787952a5fae5b6077b0ad449fd5f400315018d8c6a929d92e2883c9197446d63f8e7ca105b9ceaaaf1c73309ece49

  • SSDEEP

    3072:6TQm9aGcFqk4EJupCRjC7zg0gIg0g0gcgcgcgn4KNJreS5pAgYIqGvJ6887lbyMr:64FqfCupCRe7xKNJrdZMGXF5ahdt3

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0e94e681cd685a744d73431a7ed58b22481c930351750b08d14f0d395a8812c2N.exe

    • Size

      217KB

    • MD5

      add6419916c257601857031c8aa441f0

    • SHA1

      215967c1b9ed5af7afc92842ddcc4cdf43732f07

    • SHA256

      0e94e681cd685a744d73431a7ed58b22481c930351750b08d14f0d395a8812c2

    • SHA512

      74030b702824c15add175a076c2bf2c9c8e787952a5fae5b6077b0ad449fd5f400315018d8c6a929d92e2883c9197446d63f8e7ca105b9ceaaaf1c73309ece49

    • SSDEEP

      3072:6TQm9aGcFqk4EJupCRjC7zg0gIg0g0gcgcgcgn4KNJreS5pAgYIqGvJ6887lbyMr:64FqfCupCRe7xKNJrdZMGXF5ahdt3

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks