Overview

overview

10

Static

static

3

7ba3c2ef44...fd.exe

windows7-x64

10

7ba3c2ef44...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ba3c2ef440dda03bb7fc02b6906ddbd3432cc62f506796589cc266f110122fd

  • Size

    512KB

  • Sample

    250307-wl7wksvmx3

  • MD5

    2128c014ab7022dde385b2d071cc383e

  • SHA1

    b4c498ce621ccd4d30ff356ebf2c9037b0ce131e

  • SHA256

    7ba3c2ef440dda03bb7fc02b6906ddbd3432cc62f506796589cc266f110122fd

  • SHA512

    ec597b3d8ffd8eaa6db2a266d45ee041034c9e2560ad6f1c4fb6aaa00ea98ee480de04415f07475f3ea8456412a78ace4fae1a8649b7f356626d089fb953bfee

  • SSDEEP

    6144:QYHqJ55xxEzie6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJSZO5f7wj78:QYKJ5CfkY660fIaDZkY660f8jTK/Xhdz

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7ba3c2ef440dda03bb7fc02b6906ddbd3432cc62f506796589cc266f110122fd

    • Size

      512KB

    • MD5

      2128c014ab7022dde385b2d071cc383e

    • SHA1

      b4c498ce621ccd4d30ff356ebf2c9037b0ce131e

    • SHA256

      7ba3c2ef440dda03bb7fc02b6906ddbd3432cc62f506796589cc266f110122fd

    • SHA512

      ec597b3d8ffd8eaa6db2a266d45ee041034c9e2560ad6f1c4fb6aaa00ea98ee480de04415f07475f3ea8456412a78ace4fae1a8649b7f356626d089fb953bfee

    • SSDEEP

      6144:QYHqJ55xxEzie6UK+42GTQMJSZO5f7M0rx7/hP66qve6UK+42GTQMJSZO5f7wj78:QYKJ5CfkY660fIaDZkY660f8jTK/Xhdz

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks