Overview

overview

10

Static

static

10

f5bcb2f15c...aN.exe

windows7-x64

10

f5bcb2f15c...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f5bcb2f15c6546d6023c2579eee9e6dbfac1943c29836853d057ec15e4c7992aN.exe

  • Size

    470KB

  • Sample

    241225-tzpwtaymfq

  • MD5

    9004971ad0a99dd1389ed2f76cfaf350

  • SHA1

    24a8c10d9e6e48676b27996131b374fb13bfa1d9

  • SHA256

    f5bcb2f15c6546d6023c2579eee9e6dbfac1943c29836853d057ec15e4c7992a

  • SHA512

    189ffc3dfa936e3331b666fbc2fabbf3542fc5f268d997b16a937b566056bfdb55638958b376334f7f81b063a0113f6a43f7d1142edd62762881ddf276f22e69

  • SSDEEP

    12288:2A3Nq5qv/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9cM:28Nnv4K

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f5bcb2f15c6546d6023c2579eee9e6dbfac1943c29836853d057ec15e4c7992aN.exe

    • Size

      470KB

    • MD5

      9004971ad0a99dd1389ed2f76cfaf350

    • SHA1

      24a8c10d9e6e48676b27996131b374fb13bfa1d9

    • SHA256

      f5bcb2f15c6546d6023c2579eee9e6dbfac1943c29836853d057ec15e4c7992a

    • SHA512

      189ffc3dfa936e3331b666fbc2fabbf3542fc5f268d997b16a937b566056bfdb55638958b376334f7f81b063a0113f6a43f7d1142edd62762881ddf276f22e69

    • SSDEEP

      12288:2A3Nq5qv/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9cM:28Nnv4K

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks