General

  • Target

    9454475af55102b68b3a0a1a2d3d27219734f6003c230f37bfed7b3dcf7bc7faN

  • Size

    120KB

  • Sample

    241107-dhmr5asrdz

  • MD5

    1f978e63557ecbfdb500f3128844c860

  • SHA1

    9614c25e19c7911406e5dd2a71d96f138fddc6b1

  • SHA256

    9454475af55102b68b3a0a1a2d3d27219734f6003c230f37bfed7b3dcf7bc7fa

  • SHA512

    2158c9a0e8b4a4aeb24bdcc58424be309a02c2a32eb51918332c15c2f885bc1389ea1ff220cfd8941e18ff710e9a2eef34b005d55aa2cccf0e355463b43a040f

  • SSDEEP

    1536:4pqwxWlfirn5ddRtQatqFxrFK91WPODeAZejz0cZ44mjD9r823F4:4gwMlfS5ddRtQuq7HGTZfi/mjRrz3C

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      9454475af55102b68b3a0a1a2d3d27219734f6003c230f37bfed7b3dcf7bc7faN

    • Size

      120KB

    • MD5

      1f978e63557ecbfdb500f3128844c860

    • SHA1

      9614c25e19c7911406e5dd2a71d96f138fddc6b1

    • SHA256

      9454475af55102b68b3a0a1a2d3d27219734f6003c230f37bfed7b3dcf7bc7fa

    • SHA512

      2158c9a0e8b4a4aeb24bdcc58424be309a02c2a32eb51918332c15c2f885bc1389ea1ff220cfd8941e18ff710e9a2eef34b005d55aa2cccf0e355463b43a040f

    • SSDEEP

      1536:4pqwxWlfirn5ddRtQatqFxrFK91WPODeAZejz0cZ44mjD9r823F4:4gwMlfS5ddRtQuq7HGTZfi/mjRrz3C

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks