Overview

overview

10

Static

static

10

e206a7c432...4N.exe

windows7-x64

10

e206a7c432...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e206a7c4328b9e9dba5dbe85b84bd94d1db9c5f14a2f11d2f1f2a0ca39bb2164N.exe

  • Size

    320KB

  • Sample

    241225-w7t7lssnhq

  • MD5

    3b5ac21faf76adcafe0b2230277411d0

  • SHA1

    41c1400b9cf2c37ceaa36557a1385ade887baa88

  • SHA256

    e206a7c4328b9e9dba5dbe85b84bd94d1db9c5f14a2f11d2f1f2a0ca39bb2164

  • SHA512

    28356a8b09b983f4533cd1e316ba0aa9d6c27587ea1a8fea64a3b71dd7fc0a82c89a6858ee20fc5742d07915bdf55e3a41c139a79d31931a4e0f0f0560d9e86c

  • SSDEEP

    6144:otL2xFCkWF9C9A8/QO+zrWnAdqjeOpKfduBX2QO+zrWnAdqjsqwZ:otLo48/+zrWAI5KFum/+zrWAIAq+

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      e206a7c4328b9e9dba5dbe85b84bd94d1db9c5f14a2f11d2f1f2a0ca39bb2164N.exe

    • Size

      320KB

    • MD5

      3b5ac21faf76adcafe0b2230277411d0

    • SHA1

      41c1400b9cf2c37ceaa36557a1385ade887baa88

    • SHA256

      e206a7c4328b9e9dba5dbe85b84bd94d1db9c5f14a2f11d2f1f2a0ca39bb2164

    • SHA512

      28356a8b09b983f4533cd1e316ba0aa9d6c27587ea1a8fea64a3b71dd7fc0a82c89a6858ee20fc5742d07915bdf55e3a41c139a79d31931a4e0f0f0560d9e86c

    • SSDEEP

      6144:otL2xFCkWF9C9A8/QO+zrWnAdqjeOpKfduBX2QO+zrWnAdqjsqwZ:otLo48/+zrWAI5KFum/+zrWAIAq+

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks