Overview

overview

10

Static

static

3

f988b31b21...c1.exe

windows7-x64

10

f988b31b21...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f988b31b2157fccb99e064c64740587369846c7cf08b8c7bebbe9f38fae76ec1

  • Size

    93KB

  • Sample

    250218-j26bgaypcn

  • MD5

    70c73ccadc58ca2dd479f9f6ef02f117

  • SHA1

    9b87a8a5a37f66121ca9fa20d3786339ee7c07f0

  • SHA256

    f988b31b2157fccb99e064c64740587369846c7cf08b8c7bebbe9f38fae76ec1

  • SHA512

    504b5f62031c076b2b30dfc56f0301f91ea77db1440e95af116698b68b0156d01e6217153ff408361fb580be0af4e56c84cb50ab20f31b8467f3a508604d9cd0

  • SSDEEP

    1536:xh7JHWnoXX61X/6bT1EDNrZyIa6oX9IVrOa7a3WjfRx5NTcjiwg58:xRZWoXX6R6v1EDiIOt3a7aGj5x5NoY58

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f988b31b2157fccb99e064c64740587369846c7cf08b8c7bebbe9f38fae76ec1

    • Size

      93KB

    • MD5

      70c73ccadc58ca2dd479f9f6ef02f117

    • SHA1

      9b87a8a5a37f66121ca9fa20d3786339ee7c07f0

    • SHA256

      f988b31b2157fccb99e064c64740587369846c7cf08b8c7bebbe9f38fae76ec1

    • SHA512

      504b5f62031c076b2b30dfc56f0301f91ea77db1440e95af116698b68b0156d01e6217153ff408361fb580be0af4e56c84cb50ab20f31b8467f3a508604d9cd0

    • SSDEEP

      1536:xh7JHWnoXX61X/6bT1EDNrZyIa6oX9IVrOa7a3WjfRx5NTcjiwg58:xRZWoXX6R6v1EDiIOt3a7aGj5x5NoY58

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks