Overview

overview

10

Static

static

3

2cfdad453c...76.exe

windows7-x64

10

2cfdad453c...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cfdad453ca960f902c286ec1da35b0ccfcaa6ec5042178c92689507fd729a76

  • Size

    73KB

  • Sample

    250307-af7sqs1mx8

  • MD5

    a5506def9f085d2f0f0285547bcf3510

  • SHA1

    cb9c04e3f89e6fb25e6a6f60fb479b75171597f1

  • SHA256

    2cfdad453ca960f902c286ec1da35b0ccfcaa6ec5042178c92689507fd729a76

  • SHA512

    759c6e72928decca57c2c02253cc421604da179bb717644bfaf6f43901a75f2582a51f226df2aad8536ffe49751dea0ac77331676435d45251a850245f753083

  • SSDEEP

    1536:E9QZq4N1czJsInNYqHV7mWSyzS+1vFMr15/wJAqOuuwuuuuuuuuuuuuuu8uuuuuJ:dZLN1cyC2qwWS2DF81Bw+q2a3

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2cfdad453ca960f902c286ec1da35b0ccfcaa6ec5042178c92689507fd729a76

    • Size

      73KB

    • MD5

      a5506def9f085d2f0f0285547bcf3510

    • SHA1

      cb9c04e3f89e6fb25e6a6f60fb479b75171597f1

    • SHA256

      2cfdad453ca960f902c286ec1da35b0ccfcaa6ec5042178c92689507fd729a76

    • SHA512

      759c6e72928decca57c2c02253cc421604da179bb717644bfaf6f43901a75f2582a51f226df2aad8536ffe49751dea0ac77331676435d45251a850245f753083

    • SSDEEP

      1536:E9QZq4N1czJsInNYqHV7mWSyzS+1vFMr15/wJAqOuuwuuuuuuuuuuuuuu8uuuuuJ:dZLN1cyC2qwWS2DF81Bw+q2a3

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks