Overview

overview

10

Static

static

3

907fd43d6e...dN.exe

windows7-x64

10

907fd43d6e...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    907fd43d6ea6758fbfea8d9897102c5aa792a80c9811d7cd6fdbec5f2db5ccddN.exe

  • Size

    74KB

  • Sample

    250120-k6p1qaslej

  • MD5

    9ebfaf20ff71ed455016c10d5f08ec00

  • SHA1

    1c0d144083e59a680fe2d2a337effb7ba73e8ee6

  • SHA256

    907fd43d6ea6758fbfea8d9897102c5aa792a80c9811d7cd6fdbec5f2db5ccdd

  • SHA512

    1d1894dcd8a099f66a0441bb4672423d4ae35f1b60cecd2fd01693452f5b6de6ce3f84c9ca8514cbeb5b0a6e9fb1a20464b319a953ac0e57654d8c43ef1f5da0

  • SSDEEP

    1536:x6dpmK+5OfvwTz9X2NMo7sGqzK7onXPawWQjzPR:Sp1+UXwQphkK7onf+iPR

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      907fd43d6ea6758fbfea8d9897102c5aa792a80c9811d7cd6fdbec5f2db5ccddN.exe

    • Size

      74KB

    • MD5

      9ebfaf20ff71ed455016c10d5f08ec00

    • SHA1

      1c0d144083e59a680fe2d2a337effb7ba73e8ee6

    • SHA256

      907fd43d6ea6758fbfea8d9897102c5aa792a80c9811d7cd6fdbec5f2db5ccdd

    • SHA512

      1d1894dcd8a099f66a0441bb4672423d4ae35f1b60cecd2fd01693452f5b6de6ce3f84c9ca8514cbeb5b0a6e9fb1a20464b319a953ac0e57654d8c43ef1f5da0

    • SSDEEP

      1536:x6dpmK+5OfvwTz9X2NMo7sGqzK7onXPawWQjzPR:Sp1+UXwQphkK7onf+iPR

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks