Overview

overview

10

Static

static

3

15e688c7f1...88.exe

windows7-x64

10

15e688c7f1...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15e688c7f1a8220983aa921df3f7a6b2fbf11344334fb7c3229aeb662afc1a88

  • Size

    90KB

  • Sample

    250306-z5pe5aykw3

  • MD5

    bdae2f27ef95c0055282930f01dfffbb

  • SHA1

    b184b91a079e398253ed5951f55914db3248fc33

  • SHA256

    15e688c7f1a8220983aa921df3f7a6b2fbf11344334fb7c3229aeb662afc1a88

  • SHA512

    b6b9fb25a97939e35a24b1debdb83ceeb762d27abf03b1534fb8e46e7900e2c1dd32740335f95897a2d19dd4c30041f072bb8072c8c00db1449c5632e0530d8b

  • SSDEEP

    1536:8xQKKZyVSjvEfP+jdatj7OdXKB+NBTWac/92vZXXfOOQ/4BrGTI5Yxj:8eNyUNjwtj7Oq+NB6J/94fU/4kT0Yxj

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      15e688c7f1a8220983aa921df3f7a6b2fbf11344334fb7c3229aeb662afc1a88

    • Size

      90KB

    • MD5

      bdae2f27ef95c0055282930f01dfffbb

    • SHA1

      b184b91a079e398253ed5951f55914db3248fc33

    • SHA256

      15e688c7f1a8220983aa921df3f7a6b2fbf11344334fb7c3229aeb662afc1a88

    • SHA512

      b6b9fb25a97939e35a24b1debdb83ceeb762d27abf03b1534fb8e46e7900e2c1dd32740335f95897a2d19dd4c30041f072bb8072c8c00db1449c5632e0530d8b

    • SSDEEP

      1536:8xQKKZyVSjvEfP+jdatj7OdXKB+NBTWac/92vZXXfOOQ/4BrGTI5Yxj:8eNyUNjwtj7Oq+NB6J/94fU/4kT0Yxj

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks