Overview

overview

10

Static

static

3

c6dd7d19c8...99.exe

windows7-x64

10

c6dd7d19c8...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6dd7d19c849d7508e290c5f7ebe5a7307ce1344f18595a00b038c1b45e2c799

  • Size

    187KB

  • Sample

    250306-m19t2swybw

  • MD5

    039b2bea424707c8196ee400cc8172dd

  • SHA1

    40b21057b14ff23c68594b8522c3550b12717682

  • SHA256

    c6dd7d19c849d7508e290c5f7ebe5a7307ce1344f18595a00b038c1b45e2c799

  • SHA512

    1e27b52d83c4f0ebfc85bea03a54c9bd0b10a917043eaf6a3166c331d827f5e5c173cd5c27cd0f73c0ca3efe0b57cb54b64203bacbac2cace4c7155c6bdf1974

  • SSDEEP

    3072:EfbYgEnUawsx7FWqUkfm9/Mx2etKdVUzpaeZZl2NkzwH5GJks8WYlOWe7VsayDZ+:EWNfm9/k2TTgvb9zwZ9s8SZq/svL

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      c6dd7d19c849d7508e290c5f7ebe5a7307ce1344f18595a00b038c1b45e2c799

    • Size

      187KB

    • MD5

      039b2bea424707c8196ee400cc8172dd

    • SHA1

      40b21057b14ff23c68594b8522c3550b12717682

    • SHA256

      c6dd7d19c849d7508e290c5f7ebe5a7307ce1344f18595a00b038c1b45e2c799

    • SHA512

      1e27b52d83c4f0ebfc85bea03a54c9bd0b10a917043eaf6a3166c331d827f5e5c173cd5c27cd0f73c0ca3efe0b57cb54b64203bacbac2cace4c7155c6bdf1974

    • SSDEEP

      3072:EfbYgEnUawsx7FWqUkfm9/Mx2etKdVUzpaeZZl2NkzwH5GJks8WYlOWe7VsayDZ+:EWNfm9/k2TTgvb9zwZ9s8SZq/svL

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks