Overview

overview

10

Static

static

3

570c9fe014...94.exe

windows7-x64

10

570c9fe014...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    570c9fe0147cd20138a365e6270d4cc0686892f8a4296160022194d1e75bc394

  • Size

    280KB

  • Sample

    250306-cj4llavwft

  • MD5

    0988dd3c408ca3e7ed8e262a23032471

  • SHA1

    1ed2a7cd384aa6dce4bb8e25c4ab3488e39678a3

  • SHA256

    570c9fe0147cd20138a365e6270d4cc0686892f8a4296160022194d1e75bc394

  • SHA512

    012fc3deafdff4965a8f1cf41d6f307ec5323f3a65a692729de84f820209cb41d7141024e70466e8c3f454ddd1ebc583a2f761c206789e5b9a47429f650e926c

  • SSDEEP

    6144:dwMjPjJfC1nZIqtn4Ni/GOORjMmRUoooooooooooooooooooooooooy/GF:dwM5qnZQi//OVLCooooooooooooooooC

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      570c9fe0147cd20138a365e6270d4cc0686892f8a4296160022194d1e75bc394

    • Size

      280KB

    • MD5

      0988dd3c408ca3e7ed8e262a23032471

    • SHA1

      1ed2a7cd384aa6dce4bb8e25c4ab3488e39678a3

    • SHA256

      570c9fe0147cd20138a365e6270d4cc0686892f8a4296160022194d1e75bc394

    • SHA512

      012fc3deafdff4965a8f1cf41d6f307ec5323f3a65a692729de84f820209cb41d7141024e70466e8c3f454ddd1ebc583a2f761c206789e5b9a47429f650e926c

    • SSDEEP

      6144:dwMjPjJfC1nZIqtn4Ni/GOORjMmRUoooooooooooooooooooooooooy/GF:dwM5qnZQi//OVLCooooooooooooooooC

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks