Overview

overview

10

Static

static

3

8e44812e1b...22.exe

windows7-x64

10

8e44812e1b...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e44812e1b433e90f0e6239700662345ebbf45833110933ef02c874873e74d22

  • Size

    74KB

  • Sample

    250308-a3a3aazsfy

  • MD5

    810ecf1bc52c7fe9298f59c9ef511aac

  • SHA1

    3026540bac6de303a40528393a0ab041a2ff1de9

  • SHA256

    8e44812e1b433e90f0e6239700662345ebbf45833110933ef02c874873e74d22

  • SHA512

    bbedfbd624ac88d88e0daa42d4e70e8c141a9e279e2b70020005f42463a020d14afca3cc3ef964f5acad22ce39aab644f1d5169542ccd00e9dfd755e31d674c6

  • SSDEEP

    1536:RumD4+HxKwruLK56Z7oJPa3bgWAdk3NNsdTFx0N6:k43HxK1LK5ioJwgkdNkCN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8e44812e1b433e90f0e6239700662345ebbf45833110933ef02c874873e74d22

    • Size

      74KB

    • MD5

      810ecf1bc52c7fe9298f59c9ef511aac

    • SHA1

      3026540bac6de303a40528393a0ab041a2ff1de9

    • SHA256

      8e44812e1b433e90f0e6239700662345ebbf45833110933ef02c874873e74d22

    • SHA512

      bbedfbd624ac88d88e0daa42d4e70e8c141a9e279e2b70020005f42463a020d14afca3cc3ef964f5acad22ce39aab644f1d5169542ccd00e9dfd755e31d674c6

    • SSDEEP

      1536:RumD4+HxKwruLK56Z7oJPa3bgWAdk3NNsdTFx0N6:k43HxK1LK5ioJwgkdNkCN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Berbew family

      berbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks