Overview

overview

10

Static

static

3

66d4b8ff19...c5.exe

windows7-x64

10

66d4b8ff19...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    66d4b8ff19dc3e98ceed9627513daa6428bf15dd914565ae8335af2f88866bc5

  • Size

    89KB

  • Sample

    250307-n698faztg1

  • MD5

    4b186061587d8e82d772442e66717a85

  • SHA1

    a99439061216a80c4e6efd8d05e5d31a65387932

  • SHA256

    66d4b8ff19dc3e98ceed9627513daa6428bf15dd914565ae8335af2f88866bc5

  • SHA512

    b64ebd9089e6f550afab64668e89f893ff65b383a46818450d20b6eae9633dac18970bd735225512e44dfcbef5878bd6595f7647116293ed7c9739ca77ddf8d8

  • SSDEEP

    1536:58gzE0BnRgZGW0HWG994ZXvHnBvfL/9vC4n4mBfnApAAAAdNdbVncFlExkg8F:58gzEWGSHD94ZXvJ5p5nApAAAA/cFla4

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      66d4b8ff19dc3e98ceed9627513daa6428bf15dd914565ae8335af2f88866bc5

    • Size

      89KB

    • MD5

      4b186061587d8e82d772442e66717a85

    • SHA1

      a99439061216a80c4e6efd8d05e5d31a65387932

    • SHA256

      66d4b8ff19dc3e98ceed9627513daa6428bf15dd914565ae8335af2f88866bc5

    • SHA512

      b64ebd9089e6f550afab64668e89f893ff65b383a46818450d20b6eae9633dac18970bd735225512e44dfcbef5878bd6595f7647116293ed7c9739ca77ddf8d8

    • SSDEEP

      1536:58gzE0BnRgZGW0HWG994ZXvHnBvfL/9vC4n4mBfnApAAAAdNdbVncFlExkg8F:58gzEWGSHD94ZXvJ5p5nApAAAA/cFla4

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks