Overview

overview

10

Static

static

3

a8c07f8bc1...c0.exe

windows7-x64

10

a8c07f8bc1...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8c07f8bc114bf18dd1bf0fc2f354c1aa7a5545ab12ed982318686e4a6c852c0.exe

  • Size

    74KB

  • Sample

    241225-xjj76ssphw

  • MD5

    3105c092f2c7c142d41217af3dfed712

  • SHA1

    39c2504ef09b3bb6334d6e0e884430201d6f9a42

  • SHA256

    a8c07f8bc114bf18dd1bf0fc2f354c1aa7a5545ab12ed982318686e4a6c852c0

  • SHA512

    25545142c9633e4d4924b09d11de367d5b5a5704f5d2a3557b92b9ba02784fcf62006ec47f55508a8e8e646e012b8c68af015c20d27aed9f2f7f15dd555daf2d

  • SSDEEP

    768:3NLCGNj9PowKvk/qO7BnB/nTMM8CjkNKK3PBYm3qwIrQtoRwKvt2+Wu2vPvkjAtv:RNxPxBBfzkNKK3ZYm3qT0tratXWuBvY

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      a8c07f8bc114bf18dd1bf0fc2f354c1aa7a5545ab12ed982318686e4a6c852c0.exe

    • Size

      74KB

    • MD5

      3105c092f2c7c142d41217af3dfed712

    • SHA1

      39c2504ef09b3bb6334d6e0e884430201d6f9a42

    • SHA256

      a8c07f8bc114bf18dd1bf0fc2f354c1aa7a5545ab12ed982318686e4a6c852c0

    • SHA512

      25545142c9633e4d4924b09d11de367d5b5a5704f5d2a3557b92b9ba02784fcf62006ec47f55508a8e8e646e012b8c68af015c20d27aed9f2f7f15dd555daf2d

    • SSDEEP

      768:3NLCGNj9PowKvk/qO7BnB/nTMM8CjkNKK3PBYm3qwIrQtoRwKvt2+Wu2vPvkjAtv:RNxPxBBfzkNKK3ZYm3qT0tratXWuBvY

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks