Overview

overview

10

Static

static

3

feb48eab06...d6.exe

windows7-x64

10

feb48eab06...d6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    feb48eab06863fefd2271b26f7556c5a2c76a44730cb81cf1bef4e1a8b1f84d6

  • Size

    95KB

  • Sample

    250218-kbhm6ayphq

  • MD5

    26509a627079ddc84571d3673e10d486

  • SHA1

    27284523fd4d59efe8158d760e93eb31161eeeff

  • SHA256

    feb48eab06863fefd2271b26f7556c5a2c76a44730cb81cf1bef4e1a8b1f84d6

  • SHA512

    805d3ed1ed7b60e8531f8116dceac0a5caeb524011af916a45e5a2e958fa56836b30a4118d4c5454e73f4d5f478fe2ef0972b6fad75c6759ef2d280582ce46fd

  • SSDEEP

    1536:xEzYbd6d4lnd6+LhfyZxvnbbzBhkKCLmQQryrIbTRQrfRVRoRch1dROrwpOudRiJ:2ULYqyZxvbbzBK/LmQQry0bTeTTWM1dK

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      feb48eab06863fefd2271b26f7556c5a2c76a44730cb81cf1bef4e1a8b1f84d6

    • Size

      95KB

    • MD5

      26509a627079ddc84571d3673e10d486

    • SHA1

      27284523fd4d59efe8158d760e93eb31161eeeff

    • SHA256

      feb48eab06863fefd2271b26f7556c5a2c76a44730cb81cf1bef4e1a8b1f84d6

    • SHA512

      805d3ed1ed7b60e8531f8116dceac0a5caeb524011af916a45e5a2e958fa56836b30a4118d4c5454e73f4d5f478fe2ef0972b6fad75c6759ef2d280582ce46fd

    • SSDEEP

      1536:xEzYbd6d4lnd6+LhfyZxvnbbzBhkKCLmQQryrIbTRQrfRVRoRch1dROrwpOudRiJ:2ULYqyZxvbbzBK/LmQQry0bTeTTWM1dK

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks