Overview

overview

10

Static

static

3

916a959581...93.exe

windows7-x64

10

916a959581...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    916a9595815f43e0835f58bc0a67778a62d2e7c08c7975631bb68e93ea6d4893

  • Size

    88KB

  • Sample

    250306-htchrasmz6

  • MD5

    39d2cece435759e0d17e54651d5dad26

  • SHA1

    dc49123dc26271e6582d298cb43606ad58708414

  • SHA256

    916a9595815f43e0835f58bc0a67778a62d2e7c08c7975631bb68e93ea6d4893

  • SHA512

    2fbee0d5b052674b7108ba27019e0c3f3824abd5003a4c4954f2d3c0756a299208980de538a692032ddb0838d1ef79e910e0d4aeaccd03f4265c7b308ecb566a

  • SSDEEP

    1536:XHtJOU3ivil26d8nmHs4kgZBO4XS+er0m0nWS3WumcuVtlnouy8L:9J3VxkmHVZB/XSB4mQWSB4VjoutL

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      916a9595815f43e0835f58bc0a67778a62d2e7c08c7975631bb68e93ea6d4893

    • Size

      88KB

    • MD5

      39d2cece435759e0d17e54651d5dad26

    • SHA1

      dc49123dc26271e6582d298cb43606ad58708414

    • SHA256

      916a9595815f43e0835f58bc0a67778a62d2e7c08c7975631bb68e93ea6d4893

    • SHA512

      2fbee0d5b052674b7108ba27019e0c3f3824abd5003a4c4954f2d3c0756a299208980de538a692032ddb0838d1ef79e910e0d4aeaccd03f4265c7b308ecb566a

    • SSDEEP

      1536:XHtJOU3ivil26d8nmHs4kgZBO4XS+er0m0nWS3WumcuVtlnouy8L:9J3VxkmHVZB/XSB4mQWSB4VjoutL

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks