Overview

overview

10

Static

static

3

7c7c21eb2d...17.exe

windows7-x64

10

7c7c21eb2d...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7c7c21eb2ddf8016c0aaabe0880f59fa78aa0f85e0e2d12953bb913c29b7b717

  • Size

    288KB

  • Sample

    250118-e51syasqcz

  • MD5

    d9de8af56ed41864954facd22f5fc0b9

  • SHA1

    d5ac3d1ad21532dea80e3462324771afc975ce65

  • SHA256

    7c7c21eb2ddf8016c0aaabe0880f59fa78aa0f85e0e2d12953bb913c29b7b717

  • SHA512

    56cac1dcd119a9b92ee94bc12986f40d6ba78d1d0bccb5be9dd22a3693179d740890869797c3637a7c9e60ca61fbf729a7fbaf6e3951127950277ee21dd0258c

  • SSDEEP

    3072:82IXX7ojPq8utB0x3WbQ5Teld7LDT1Yx07KlFYzqpCZSLMi5lQvuIbuzj1DukJFj:8FniC84B0sPLl+wGXAF2PbgKLV9

Score
10/10
berbewbruteratelbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7c7c21eb2ddf8016c0aaabe0880f59fa78aa0f85e0e2d12953bb913c29b7b717

    • Size

      288KB

    • MD5

      d9de8af56ed41864954facd22f5fc0b9

    • SHA1

      d5ac3d1ad21532dea80e3462324771afc975ce65

    • SHA256

      7c7c21eb2ddf8016c0aaabe0880f59fa78aa0f85e0e2d12953bb913c29b7b717

    • SHA512

      56cac1dcd119a9b92ee94bc12986f40d6ba78d1d0bccb5be9dd22a3693179d740890869797c3637a7c9e60ca61fbf729a7fbaf6e3951127950277ee21dd0258c

    • SSDEEP

      3072:82IXX7ojPq8utB0x3WbQ5Teld7LDT1Yx07KlFYzqpCZSLMi5lQvuIbuzj1DukJFj:8FniC84B0sPLl+wGXAF2PbgKLV9

    Score
    10/10
    berbewbruteratelbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • Bruteratel family

      bruteratel

    • Detect BruteRatel badger

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks