General

  • Target

    d668ad4c7a05c83c7315465150e0ef7c4363d7306448af0ef02062f7be54858aN

  • Size

    104KB

  • Sample

    241107-d4ba8avcjf

  • MD5

    8c52e579289a1b1bc74cac17eea7da30

  • SHA1

    164edd35499939d49a9ef6ceb0a1f1bfe5d2382b

  • SHA256

    d668ad4c7a05c83c7315465150e0ef7c4363d7306448af0ef02062f7be54858a

  • SHA512

    c2a4f403125972ffd988f785aad6ab56cb2b9a1f4e867d40cd2abb2d861b0a25788fd394b1da277084022640d3ab1038569c300dfcde0257bab54f9f550a3b5e

  • SSDEEP

    3072:isuXgoJ5KYvQwnZdtvQWdiiii6e5e5Jx7cEGrhkngpDvchkqbAIQS:ihgGrQwnrtvQWdiiii6H5Jx4brq2Ahn

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d668ad4c7a05c83c7315465150e0ef7c4363d7306448af0ef02062f7be54858aN

    • Size

      104KB

    • MD5

      8c52e579289a1b1bc74cac17eea7da30

    • SHA1

      164edd35499939d49a9ef6ceb0a1f1bfe5d2382b

    • SHA256

      d668ad4c7a05c83c7315465150e0ef7c4363d7306448af0ef02062f7be54858a

    • SHA512

      c2a4f403125972ffd988f785aad6ab56cb2b9a1f4e867d40cd2abb2d861b0a25788fd394b1da277084022640d3ab1038569c300dfcde0257bab54f9f550a3b5e

    • SSDEEP

      3072:isuXgoJ5KYvQwnZdtvQWdiiii6e5e5Jx7cEGrhkngpDvchkqbAIQS:ihgGrQwnrtvQWdiiii6H5Jx4brq2Ahn

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks