Overview

overview

10

Static

static

3

bd108f2dfc...a8.exe

windows7-x64

10

bd108f2dfc...a8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bd108f2dfc329ff6675102375f30e20d1f4c2bd6d601e726f07cc06a528a69a8

  • Size

    1.6MB

  • Sample

    250306-maxf2av1hv

  • MD5

    161161e47a85c928ceceae93256604cc

  • SHA1

    7b2d7f07b99ceda4136f2afbb9de70b79f9cf139

  • SHA256

    bd108f2dfc329ff6675102375f30e20d1f4c2bd6d601e726f07cc06a528a69a8

  • SHA512

    8eecc8e136da7cabfd0c3799d6f7af63b746db4ab847393d9acea5e31b052a6947d6e4048a6e29c94e87d36339e6f43906bea469c394d9822a0f5e9fd4d00cb9

  • SSDEEP

    3072:N8Yw7s6faOd8Hwdlvt7p3FU6UK7q4+5DbGTO6GQd3JSZO5:KYis6faNWv9p3e6UK+42GTQMJSZO5

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bd108f2dfc329ff6675102375f30e20d1f4c2bd6d601e726f07cc06a528a69a8

    • Size

      1.6MB

    • MD5

      161161e47a85c928ceceae93256604cc

    • SHA1

      7b2d7f07b99ceda4136f2afbb9de70b79f9cf139

    • SHA256

      bd108f2dfc329ff6675102375f30e20d1f4c2bd6d601e726f07cc06a528a69a8

    • SHA512

      8eecc8e136da7cabfd0c3799d6f7af63b746db4ab847393d9acea5e31b052a6947d6e4048a6e29c94e87d36339e6f43906bea469c394d9822a0f5e9fd4d00cb9

    • SSDEEP

      3072:N8Yw7s6faOd8Hwdlvt7p3FU6UK7q4+5DbGTO6GQd3JSZO5:KYis6faNWv9p3e6UK+42GTQMJSZO5

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks