Overview

overview

10

Static

static

3

5e14213bd1...ac.exe

windows7-x64

10

5e14213bd1...ac.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e14213bd17bf478cabd1d9115872eac96e845f0809c0fdd1f624f97b85bc3ac

  • Size

    74KB

  • Sample

    250306-c7zybawq16

  • MD5

    3e8e5dcbe9cdf704f2544bd08431b77a

  • SHA1

    83cc1b6c76a42bfcae98c38b9bb489a38806b74b

  • SHA256

    5e14213bd17bf478cabd1d9115872eac96e845f0809c0fdd1f624f97b85bc3ac

  • SHA512

    5a325fbd8ab2b8df92a43d5db4f6a11c0f2fb0d914c76e0e1de6b43156074eb4c1ca1c10d65f9f0a1cc64097e430d09d563cd973043399660a8c98725bc02c3f

  • SSDEEP

    1536:7DTSIianicOY8NwHRZaKZW9hvJqXwwqYSP/Mqpw:7PSIywH/29zp

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      5e14213bd17bf478cabd1d9115872eac96e845f0809c0fdd1f624f97b85bc3ac

    • Size

      74KB

    • MD5

      3e8e5dcbe9cdf704f2544bd08431b77a

    • SHA1

      83cc1b6c76a42bfcae98c38b9bb489a38806b74b

    • SHA256

      5e14213bd17bf478cabd1d9115872eac96e845f0809c0fdd1f624f97b85bc3ac

    • SHA512

      5a325fbd8ab2b8df92a43d5db4f6a11c0f2fb0d914c76e0e1de6b43156074eb4c1ca1c10d65f9f0a1cc64097e430d09d563cd973043399660a8c98725bc02c3f

    • SSDEEP

      1536:7DTSIianicOY8NwHRZaKZW9hvJqXwwqYSP/Mqpw:7PSIywH/29zp

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks