Overview

overview

10

Static

static

3

21ca04e693...4N.exe

windows7-x64

10

21ca04e693...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21ca04e69354c3d3b5ff5a57e91df4d1904c44b8840445a7b5fb88de15b61684N.exe

  • Size

    128KB

  • Sample

    241225-w4j78ssjes

  • MD5

    a237e6910d4c3499f131cf2708443630

  • SHA1

    c666276be8f35f50605d5fde1e2843f3a5ea7d76

  • SHA256

    21ca04e69354c3d3b5ff5a57e91df4d1904c44b8840445a7b5fb88de15b61684

  • SHA512

    5004e0edfbf5e0b627c0002ab21b9a63b6a92576fad60fe0d190d149a59e673fa01272beb45a7db63c3a170282c1eb2c37ffba3aea924426a4a130dbc722c6e6

  • SSDEEP

    3072:feO7a+Db/SdATEU8pJI3FQo7fnEBctcp:mMayjSdAD8HI3FF7fPtc

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      21ca04e69354c3d3b5ff5a57e91df4d1904c44b8840445a7b5fb88de15b61684N.exe

    • Size

      128KB

    • MD5

      a237e6910d4c3499f131cf2708443630

    • SHA1

      c666276be8f35f50605d5fde1e2843f3a5ea7d76

    • SHA256

      21ca04e69354c3d3b5ff5a57e91df4d1904c44b8840445a7b5fb88de15b61684

    • SHA512

      5004e0edfbf5e0b627c0002ab21b9a63b6a92576fad60fe0d190d149a59e673fa01272beb45a7db63c3a170282c1eb2c37ffba3aea924426a4a130dbc722c6e6

    • SSDEEP

      3072:feO7a+Db/SdATEU8pJI3FQo7fnEBctcp:mMayjSdAD8HI3FF7fPtc

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks