Overview

overview

10

Static

static

10

6a1ccc9205...8d.exe

windows7-x64

10

6a1ccc9205...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a1ccc9205adb652cb2eba17a2b6bd018dcb17616e68ef1bc65f004e3569ba8d.exe

  • Size

    277KB

  • Sample

    250120-ky9eds1qcs

  • MD5

    2f0644232781e965e35f7f29b228ec6b

  • SHA1

    56e2134fc7428318fbefadaafdf463f60fe9c7a2

  • SHA256

    6a1ccc9205adb652cb2eba17a2b6bd018dcb17616e68ef1bc65f004e3569ba8d

  • SHA512

    a608b9c898a56f08cae0c3fcdc1e9f64ad5e1351ae4e9e9ac1098252eaf680b10cd77d3935d138574cc8b7a2acf61ba5562b0a706d3386afa08e51f3329b740f

  • SSDEEP

    6144:ubsaNqbx6aqS4ytdZMGXF5ahdt3rM8d7TtLO:rc66SjXFWtJ9q

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      6a1ccc9205adb652cb2eba17a2b6bd018dcb17616e68ef1bc65f004e3569ba8d.exe

    • Size

      277KB

    • MD5

      2f0644232781e965e35f7f29b228ec6b

    • SHA1

      56e2134fc7428318fbefadaafdf463f60fe9c7a2

    • SHA256

      6a1ccc9205adb652cb2eba17a2b6bd018dcb17616e68ef1bc65f004e3569ba8d

    • SHA512

      a608b9c898a56f08cae0c3fcdc1e9f64ad5e1351ae4e9e9ac1098252eaf680b10cd77d3935d138574cc8b7a2acf61ba5562b0a706d3386afa08e51f3329b740f

    • SSDEEP

      6144:ubsaNqbx6aqS4ytdZMGXF5ahdt3rM8d7TtLO:rc66SjXFWtJ9q

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks