Overview

overview

10

Static

static

3

74e24f3d64...e1.exe

windows7-x64

10

74e24f3d64...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74e24f3d64fc54799c2bb6441c27e40864cf88e6b1157601fcee08c4eb7faee1.exe

  • Size

    136KB

  • Sample

    241225-wjmsma1ldz

  • MD5

    df794d83f806f7da2cfb7d17be3720f2

  • SHA1

    2e29ff14156463dfaf43615f989e631284871a7c

  • SHA256

    74e24f3d64fc54799c2bb6441c27e40864cf88e6b1157601fcee08c4eb7faee1

  • SHA512

    13bb368ce62ac79fb573ea48c93538a14ec0f7badcd1d5e7151bb445ecf3f51b15d022cde347fb3c66aaccafd5ebfa27bb9a8da0c1345f7d2e2994f50ad52bf6

  • SSDEEP

    1536:im9JGjFNk9Dy+pp5T+2mVP0xVwKLnRULpLgvPP3Wjz0cZ44mjD9r823FQ75/DtXp:im9YJVslLRMpLEP3i/mjRrz3OL

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      74e24f3d64fc54799c2bb6441c27e40864cf88e6b1157601fcee08c4eb7faee1.exe

    • Size

      136KB

    • MD5

      df794d83f806f7da2cfb7d17be3720f2

    • SHA1

      2e29ff14156463dfaf43615f989e631284871a7c

    • SHA256

      74e24f3d64fc54799c2bb6441c27e40864cf88e6b1157601fcee08c4eb7faee1

    • SHA512

      13bb368ce62ac79fb573ea48c93538a14ec0f7badcd1d5e7151bb445ecf3f51b15d022cde347fb3c66aaccafd5ebfa27bb9a8da0c1345f7d2e2994f50ad52bf6

    • SSDEEP

      1536:im9JGjFNk9Dy+pp5T+2mVP0xVwKLnRULpLgvPP3Wjz0cZ44mjD9r823FQ75/DtXp:im9YJVslLRMpLEP3i/mjRrz3OL

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks