Overview

overview

10

Static

static

3

53ebb15b69...cN.exe

windows7-x64

10

53ebb15b69...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53ebb15b6985d7002486b1e13f7364384b11bbca0d86c6975755bf25a40da25cN.exe

  • Size

    128KB

  • Sample

    241225-zmt8naxkbv

  • MD5

    cb182bd0ff481f59a7bf52e81e301a40

  • SHA1

    d779370b7f792fce1413fe4c304698a669933245

  • SHA256

    53ebb15b6985d7002486b1e13f7364384b11bbca0d86c6975755bf25a40da25c

  • SHA512

    f14ad35dba8e8c988c3aa15c5d8e38d9eb66fa64b95d45929cb36cc5007c3a2d2ec7ddeb7ce33bfa081da0443c28628fe235dc29fe83bf4c282f61a95053a895

  • SSDEEP

    3072:3zS0h7Wi8ZShpDXIdeb9pui6yYPaI7DehizrVtNq:3uViV/Rhpui6yYPaIGcs

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      53ebb15b6985d7002486b1e13f7364384b11bbca0d86c6975755bf25a40da25cN.exe

    • Size

      128KB

    • MD5

      cb182bd0ff481f59a7bf52e81e301a40

    • SHA1

      d779370b7f792fce1413fe4c304698a669933245

    • SHA256

      53ebb15b6985d7002486b1e13f7364384b11bbca0d86c6975755bf25a40da25c

    • SHA512

      f14ad35dba8e8c988c3aa15c5d8e38d9eb66fa64b95d45929cb36cc5007c3a2d2ec7ddeb7ce33bfa081da0443c28628fe235dc29fe83bf4c282f61a95053a895

    • SSDEEP

      3072:3zS0h7Wi8ZShpDXIdeb9pui6yYPaI7DehizrVtNq:3uViV/Rhpui6yYPaIGcs

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks