General

  • Target

    TrojanDownloader.Win32.Berbew.pz-0c30fdbeac5f36b5013a1fae1c0950482324396a4028be3270214e3ab4ce97a5N

  • Size

    45KB

  • Sample

    240916-r1nn2atajn

  • MD5

    e14a9dfb6c0b8e2d4247d7785c4a3200

  • SHA1

    790ef440a07b94b4daf905d8ac8af6c794b81535

  • SHA256

    0c30fdbeac5f36b5013a1fae1c0950482324396a4028be3270214e3ab4ce97a5

  • SHA512

    ad61cb311d1a45a25020bc9d9faf6184f77e524c7e45f554eb35216b204d93edb44586dce2f50e234fb9f4cb7545f08311ad5ca08900253b6856899509a2566b

  • SSDEEP

    768:PxUkaj+8qL3OLlyHxQzhcumM+DLc5WMGJE0tM/1H5:PVaj+8qLgEQzhcXDLc/G+0w

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      TrojanDownloader.Win32.Berbew.pz-0c30fdbeac5f36b5013a1fae1c0950482324396a4028be3270214e3ab4ce97a5N

    • Size

      45KB

    • MD5

      e14a9dfb6c0b8e2d4247d7785c4a3200

    • SHA1

      790ef440a07b94b4daf905d8ac8af6c794b81535

    • SHA256

      0c30fdbeac5f36b5013a1fae1c0950482324396a4028be3270214e3ab4ce97a5

    • SHA512

      ad61cb311d1a45a25020bc9d9faf6184f77e524c7e45f554eb35216b204d93edb44586dce2f50e234fb9f4cb7545f08311ad5ca08900253b6856899509a2566b

    • SSDEEP

      768:PxUkaj+8qL3OLlyHxQzhcumM+DLc5WMGJE0tM/1H5:PVaj+8qLgEQzhcXDLc/G+0w

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks