Overview

overview

10

Static

static

10

f6fb48bd2e...23.exe

windows7-x64

10

f6fb48bd2e...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623

  • Size

    187KB

  • Sample

    250305-p8m2csyr15

  • MD5

    a81eaae6c4caef7ae52d2a86675fcf17

  • SHA1

    303a11ff2fea1ea71293d172d101021da24c2606

  • SHA256

    f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623

  • SHA512

    db205be2357aa5cbcc4595663eb0b1818af2c77ffe834182adbabce8f0e5941e309f54860248dc04bd09cf94664fe0bee6536573b12814866e675d9a4cded879

  • SSDEEP

    3072:5KC4SRQWIfQOkZTTgr/feXZl2NkzwH5GJks8WYlOWe7VsayDZVZev1N:5L4YTrp9zwZ9s8SZq/svL

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623

    • Size

      187KB

    • MD5

      a81eaae6c4caef7ae52d2a86675fcf17

    • SHA1

      303a11ff2fea1ea71293d172d101021da24c2606

    • SHA256

      f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623

    • SHA512

      db205be2357aa5cbcc4595663eb0b1818af2c77ffe834182adbabce8f0e5941e309f54860248dc04bd09cf94664fe0bee6536573b12814866e675d9a4cded879

    • SSDEEP

      3072:5KC4SRQWIfQOkZTTgr/feXZl2NkzwH5GJks8WYlOWe7VsayDZVZev1N:5L4YTrp9zwZ9s8SZq/svL

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks