Overview

overview

10

Static

static

10

0b55b4691f...b2.exe

windows7-x64

10

0b55b4691f...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b55b4691fb61bffa37522ec561b3e9c7fad377541870d71e232606fafd341b2.exe

  • Size

    407KB

  • Sample

    241225-ysbstsvqhs

  • MD5

    18efbe8b26da317d9045465ba9318d27

  • SHA1

    8ee759a7ab0c7604f40fb50fc08aa81cecbc3922

  • SHA256

    0b55b4691fb61bffa37522ec561b3e9c7fad377541870d71e232606fafd341b2

  • SHA512

    18c10868553438c2bb4a967aa5e0292b43f6c32bdd168d034874b01bf3b37976bdfa4e1f2b490407967cc7e7f53df98df0e626eae62f7cfa155633f5e7f45ba7

  • SSDEEP

    6144:F67TzV33pui6yYPaIGcjDpui6yYPaIGckSU05836pui6yYPaIGck/:IFHpV6yYP3pV6yYPg058KpV6yYPW

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      0b55b4691fb61bffa37522ec561b3e9c7fad377541870d71e232606fafd341b2.exe

    • Size

      407KB

    • MD5

      18efbe8b26da317d9045465ba9318d27

    • SHA1

      8ee759a7ab0c7604f40fb50fc08aa81cecbc3922

    • SHA256

      0b55b4691fb61bffa37522ec561b3e9c7fad377541870d71e232606fafd341b2

    • SHA512

      18c10868553438c2bb4a967aa5e0292b43f6c32bdd168d034874b01bf3b37976bdfa4e1f2b490407967cc7e7f53df98df0e626eae62f7cfa155633f5e7f45ba7

    • SSDEEP

      6144:F67TzV33pui6yYPaIGcjDpui6yYPaIGckSU05836pui6yYPaIGck/:IFHpV6yYP3pV6yYPg058KpV6yYPW

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks