General

  • Target

    b851535e9e0758f336dd488ce166ae2d4be0aef75ede5bc9ee0247b342598610

  • Size

    379KB

  • Sample

    241107-d6agpsvcne

  • MD5

    e79ef69def0bd606c4777ebd232cbf6c

  • SHA1

    f9536992b6ddd966d5d63c7fa234e610856cb900

  • SHA256

    b851535e9e0758f336dd488ce166ae2d4be0aef75ede5bc9ee0247b342598610

  • SHA512

    1dd59764a9a93fab7eea6e9428101f675a1b425593fbab63ef2619a4ecd6d8a7b962d12aee5c87ee2640845696665df9b214aa16269b10a644d74628dbee910a

  • SSDEEP

    6144:5c6PKitli7O/0xLxli7O//yb1c3ccU0S6GyTgfiEkrE:tKK6vxr6lGHaXyTg6EkrE

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      b851535e9e0758f336dd488ce166ae2d4be0aef75ede5bc9ee0247b342598610

    • Size

      379KB

    • MD5

      e79ef69def0bd606c4777ebd232cbf6c

    • SHA1

      f9536992b6ddd966d5d63c7fa234e610856cb900

    • SHA256

      b851535e9e0758f336dd488ce166ae2d4be0aef75ede5bc9ee0247b342598610

    • SHA512

      1dd59764a9a93fab7eea6e9428101f675a1b425593fbab63ef2619a4ecd6d8a7b962d12aee5c87ee2640845696665df9b214aa16269b10a644d74628dbee910a

    • SSDEEP

      6144:5c6PKitli7O/0xLxli7O//yb1c3ccU0S6GyTgfiEkrE:tKK6vxr6lGHaXyTg6EkrE

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks