Overview

overview

10

Static

static

3

7d2d397b0e...04.exe

windows7-x64

10

7d2d397b0e...04.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d2d397b0e59c2c09a68089f5ee13a63c71afbfe575c0d1b2d87982e85a1f704

  • Size

    96KB

  • Sample

    250306-f6r3vsztez

  • MD5

    65cd395a24dc493e4fdaad1f1df50d83

  • SHA1

    aecd9800e211510d5b605cf7ea66cff09cb52190

  • SHA256

    7d2d397b0e59c2c09a68089f5ee13a63c71afbfe575c0d1b2d87982e85a1f704

  • SHA512

    25bef3a8992a0f3dd72b13bd0c59025458b220d921baf07e37a08f16b27ee3df366e81a2cc59ceb0216ebeff7a7d903c3c6268065085b6c7ed1df8a8ca8f90d6

  • SSDEEP

    1536:fKKz2eEuKwIydJzoVx+Cp1TMpgk+2aAjWbjtKBvU:ftguKw3roV7p1TDktVwtCU

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7d2d397b0e59c2c09a68089f5ee13a63c71afbfe575c0d1b2d87982e85a1f704

    • Size

      96KB

    • MD5

      65cd395a24dc493e4fdaad1f1df50d83

    • SHA1

      aecd9800e211510d5b605cf7ea66cff09cb52190

    • SHA256

      7d2d397b0e59c2c09a68089f5ee13a63c71afbfe575c0d1b2d87982e85a1f704

    • SHA512

      25bef3a8992a0f3dd72b13bd0c59025458b220d921baf07e37a08f16b27ee3df366e81a2cc59ceb0216ebeff7a7d903c3c6268065085b6c7ed1df8a8ca8f90d6

    • SSDEEP

      1536:fKKz2eEuKwIydJzoVx+Cp1TMpgk+2aAjWbjtKBvU:ftguKw3roV7p1TDktVwtCU

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks