Overview

overview

10

Static

static

3

9edafa6528...e4.exe

windows7-x64

10

9edafa6528...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe

  • Size

    89KB

  • Sample

    241225-xmhhratlbq

  • MD5

    26a54ba706d264525c39ac505c6f39a5

  • SHA1

    192b9145c7bde0e1c12877dad94798cb89ce1f14

  • SHA256

    9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4

  • SHA512

    6aa5425a38ad8a3cd5b516fb88df1488dc8752c6c57451bb92e5e3ae39290c94116bef1b0c071d0e5faf8b908794d6caf33e83980bb2c05c2aa548c9dd795dc2

  • SSDEEP

    1536:qLSA8rrJzn/wfFD7We37WIsqaV2Be/BhB88KsbuIB7BR9L4DT2EnINb:qLSprrJz/G3CuaVienH1KIB6+oQ

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4.exe

    • Size

      89KB

    • MD5

      26a54ba706d264525c39ac505c6f39a5

    • SHA1

      192b9145c7bde0e1c12877dad94798cb89ce1f14

    • SHA256

      9edafa65286ebf25a22e60deaef528f9ef08c244e8a36ae94abd741208e277e4

    • SHA512

      6aa5425a38ad8a3cd5b516fb88df1488dc8752c6c57451bb92e5e3ae39290c94116bef1b0c071d0e5faf8b908794d6caf33e83980bb2c05c2aa548c9dd795dc2

    • SSDEEP

      1536:qLSA8rrJzn/wfFD7We37WIsqaV2Be/BhB88KsbuIB7BR9L4DT2EnINb:qLSprrJz/G3CuaVienH1KIB6+oQ

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks