Overview

overview

10

Static

static

3

b89212e741...07.exe

windows7-x64

10

b89212e741...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b89212e741dbed8e3df8240bb1c1f88b6c2855efd3cad9c5d19c1a2b4846f707.exe

  • Size

    265KB

  • Sample

    250204-ty25ratmgl

  • MD5

    5271462d33d2279664854687f699ae13

  • SHA1

    fe05733226e00a5860f54df5f1d87342dc905821

  • SHA256

    b89212e741dbed8e3df8240bb1c1f88b6c2855efd3cad9c5d19c1a2b4846f707

  • SHA512

    46447383d8b0522eadf3667f9d8059044d446aa7b8378add5b0965746090eac0a939dbfc5e7351513da5503f7f6d95ffcd250d0d0176f3727f971d1f9b948d8e

  • SSDEEP

    6144:8HT4+8bsAFM6234lKm3pT11Tgkz1581hWH:0T4+89FB24lzx1skz15LH

Score
10/10
berbewbruteratelbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b89212e741dbed8e3df8240bb1c1f88b6c2855efd3cad9c5d19c1a2b4846f707.exe

    • Size

      265KB

    • MD5

      5271462d33d2279664854687f699ae13

    • SHA1

      fe05733226e00a5860f54df5f1d87342dc905821

    • SHA256

      b89212e741dbed8e3df8240bb1c1f88b6c2855efd3cad9c5d19c1a2b4846f707

    • SHA512

      46447383d8b0522eadf3667f9d8059044d446aa7b8378add5b0965746090eac0a939dbfc5e7351513da5503f7f6d95ffcd250d0d0176f3727f971d1f9b948d8e

    • SSDEEP

      6144:8HT4+8bsAFM6234lKm3pT11Tgkz1581hWH:0T4+89FB24lzx1skz15LH

    Score
    10/10
    berbewbruteratelbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Brute Ratel C4

      A customized command and control framework for red teaming and adversary simulation.

      backdoorbruteratel

    • Bruteratel family

      bruteratel

    • Detect BruteRatel badger

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks