Overview

overview

10

Static

static

3

dff6a4b8ae...d3.exe

windows7-x64

10

dff6a4b8ae...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dff6a4b8ae7d018b0e2f36f3650f61fd5b0324167c72feebd80441a62904b4d3

  • Size

    74KB

  • Sample

    250306-qes6yszly2

  • MD5

    ab161c66ddcfbaf0a4e632469d2b1ab3

  • SHA1

    76dc76f279dff6328cc347a52b4dc898895b47c9

  • SHA256

    dff6a4b8ae7d018b0e2f36f3650f61fd5b0324167c72feebd80441a62904b4d3

  • SHA512

    64ebfa3bc1b342cad71f59f88b065af025df21548b93767e192ba2df1cc101947c70daf3655fbaad2fb5f9728e9697b2ce134136a06daa7396e3617dce8fb006

  • SSDEEP

    1536:3+dqT0i3w9mLnI8DshhTL0bHATTu94MTy5yXauZjB97VO0B:3+dS/3dLI8Ds6mTAE5yKujB9D

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      dff6a4b8ae7d018b0e2f36f3650f61fd5b0324167c72feebd80441a62904b4d3

    • Size

      74KB

    • MD5

      ab161c66ddcfbaf0a4e632469d2b1ab3

    • SHA1

      76dc76f279dff6328cc347a52b4dc898895b47c9

    • SHA256

      dff6a4b8ae7d018b0e2f36f3650f61fd5b0324167c72feebd80441a62904b4d3

    • SHA512

      64ebfa3bc1b342cad71f59f88b065af025df21548b93767e192ba2df1cc101947c70daf3655fbaad2fb5f9728e9697b2ce134136a06daa7396e3617dce8fb006

    • SSDEEP

      1536:3+dqT0i3w9mLnI8DshhTL0bHATTu94MTy5yXauZjB97VO0B:3+dS/3dLI8Ds6mTAE5yKujB9D

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks