Overview

overview

10

Static

static

3

fe962d4d5a...c1.exe

windows7-x64

10

fe962d4d5a...c1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe962d4d5acdab0bced3238a8dffe0ab89a0ac415485563197e59d10eeeccec1

  • Size

    100KB

  • Sample

    250306-s2nwvs1zhw

  • MD5

    37f99bfba705a35dfdbcb9f27ba0d039

  • SHA1

    bd5276e5a063bf1c040e055b4b76af0ae7a8503f

  • SHA256

    fe962d4d5acdab0bced3238a8dffe0ab89a0ac415485563197e59d10eeeccec1

  • SHA512

    f4af431373c9e7293210161e7a4cc8f6dbd69ce5215a9ac474bba2ea701fa0a9c6af2ff52e26df51d846d67ba488a4e284ec9b4a72056a1c881e737f7e947e1f

  • SSDEEP

    1536:uRNr3BFgahKL0OlnzAwzx7aD7BKCYXgPFgblQQa3+om13XRzT:kFg7L02/x7+BKAtgb3a3+X13XRzT

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fe962d4d5acdab0bced3238a8dffe0ab89a0ac415485563197e59d10eeeccec1

    • Size

      100KB

    • MD5

      37f99bfba705a35dfdbcb9f27ba0d039

    • SHA1

      bd5276e5a063bf1c040e055b4b76af0ae7a8503f

    • SHA256

      fe962d4d5acdab0bced3238a8dffe0ab89a0ac415485563197e59d10eeeccec1

    • SHA512

      f4af431373c9e7293210161e7a4cc8f6dbd69ce5215a9ac474bba2ea701fa0a9c6af2ff52e26df51d846d67ba488a4e284ec9b4a72056a1c881e737f7e947e1f

    • SSDEEP

      1536:uRNr3BFgahKL0OlnzAwzx7aD7BKCYXgPFgblQQa3+om13XRzT:kFg7L02/x7+BKAtgb3a3+X13XRzT

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks