berbew | f667ab9cddeb50b40983238ce5a0b641ca3c084f6a7e72a359cb741c7f51acb8 | Triage

Sharing

General

Target

f667ab9cddeb50b40983238ce5a0b641ca3c084f6a7e72a359cb741c7f51acb8N.exe
Size

187KB
Sample

241225-w2fr2asmam
MD5

e33ba6fa244b8f7f041121ac29d4a680
SHA1

bf391b1be27134531ec3ea76802a2d924751aa69
SHA256

f667ab9cddeb50b40983238ce5a0b641ca3c084f6a7e72a359cb741c7f51acb8
SHA512

1369c50a0babeb6d7c09375733cdc016f96e2a1b2c91d5eefbd46ca0d3371f43b295e90debc5d6bcce7c027fad21887392b3fc4b7dc090bdf09597e6801c4ff2
SSDEEP

3072:A3ivjiHOUJBv1GHAgBqpAylU3vDVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueH:AS7ilSggkpnlU/DV+tbFOLM77OLLt

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

- Target
  
  f667ab9cddeb50b40983238ce5a0b641ca3c084f6a7e72a359cb741c7f51acb8N.exe
- Size
  
  187KB
- MD5
  
  e33ba6fa244b8f7f041121ac29d4a680
- SHA1
  
  bf391b1be27134531ec3ea76802a2d924751aa69
- SHA256
  
  f667ab9cddeb50b40983238ce5a0b641ca3c084f6a7e72a359cb741c7f51acb8
- SHA512
  
  1369c50a0babeb6d7c09375733cdc016f96e2a1b2c91d5eefbd46ca0d3371f43b295e90debc5d6bcce7c027fad21887392b3fc4b7dc090bdf09597e6801c4ff2
- SSDEEP
  
  3072:A3ivjiHOUJBv1GHAgBqpAylU3vDVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueH:AS7ilSggkpnlU/DV+tbFOLM77OLLt
Score

10^/10

berbew backdoor discovery persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Berbew
  Berbew is a backdoor written in C++.
  backdoor berbew
- Berbew family
  berbew
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

berbewbackdoordiscoverypersistence

behavioral2

berbewbackdoordiscoverypersistence