General

  • Target

    cc34f731abfb1c4a56c81137acb860696b1348a857783f1b47ef5c4af684b451N

  • Size

    128KB

  • Sample

    241107-d7zg8atnfv

  • MD5

    808e12d180451f1dab82d308b124f950

  • SHA1

    aff513cec995cfb0482e36929132f0439cc37635

  • SHA256

    cc34f731abfb1c4a56c81137acb860696b1348a857783f1b47ef5c4af684b451

  • SHA512

    cdc0f8a62df4a8a50abeb3a2433cd0628bce8fc219624ce7fd7946eb70494458f5495f6888a92259ee353b7316a11ce1b05e168e7cb596b27708e828bbe7f97c

  • SSDEEP

    3072:tZm4PZfWCP2RwnhwcDt8Ubwf1nFzwSAJB8g:i4PZfRYwhwcp8V1n6xJmg

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      cc34f731abfb1c4a56c81137acb860696b1348a857783f1b47ef5c4af684b451N

    • Size

      128KB

    • MD5

      808e12d180451f1dab82d308b124f950

    • SHA1

      aff513cec995cfb0482e36929132f0439cc37635

    • SHA256

      cc34f731abfb1c4a56c81137acb860696b1348a857783f1b47ef5c4af684b451

    • SHA512

      cdc0f8a62df4a8a50abeb3a2433cd0628bce8fc219624ce7fd7946eb70494458f5495f6888a92259ee353b7316a11ce1b05e168e7cb596b27708e828bbe7f97c

    • SSDEEP

      3072:tZm4PZfWCP2RwnhwcDt8Ubwf1nFzwSAJB8g:i4PZfRYwhwcp8V1n6xJmg

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks