General

  • Target

    Backdoor.Win32.Padodor.SK.MTB-19aea2362aab1a965bae54fba8ed80d2766e8204d79629e453573735663e6fd1N

  • Size

    92KB

  • Sample

    240916-mzcsxstcrb

  • MD5

    0a76184fc7e3c8f77b44f6d27c64c8c0

  • SHA1

    0c150bf353619549da9734a46d180a3a54fb0631

  • SHA256

    19aea2362aab1a965bae54fba8ed80d2766e8204d79629e453573735663e6fd1

  • SHA512

    27f35cf37b751c09d95477759be6023178af909cec13892abb2c2fb5d09dc416b3f88b03c9d05f59cece9b89e784dd98478a7ca2ef0b3d501b14338c58f0dac1

  • SSDEEP

    1536:MCpECoI1sA5jOZ5Lkj+Ne3H6IsWeKIiW8btrOJnKQrUoR24HsUs:rECoIu95LvWvIYZP6THsR

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      Backdoor.Win32.Padodor.SK.MTB-19aea2362aab1a965bae54fba8ed80d2766e8204d79629e453573735663e6fd1N

    • Size

      92KB

    • MD5

      0a76184fc7e3c8f77b44f6d27c64c8c0

    • SHA1

      0c150bf353619549da9734a46d180a3a54fb0631

    • SHA256

      19aea2362aab1a965bae54fba8ed80d2766e8204d79629e453573735663e6fd1

    • SHA512

      27f35cf37b751c09d95477759be6023178af909cec13892abb2c2fb5d09dc416b3f88b03c9d05f59cece9b89e784dd98478a7ca2ef0b3d501b14338c58f0dac1

    • SSDEEP

      1536:MCpECoI1sA5jOZ5Lkj+Ne3H6IsWeKIiW8btrOJnKQrUoR24HsUs:rECoIu95LvWvIYZP6THsR

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks