General

  • Target

    b172bca2323e1f641b23c5712d44aac63c42d07cfb974e3903cd6e1a318c8947

  • Size

    570KB

  • Sample

    241107-dtj6dawqgl

  • MD5

    966220b62d7f3fb2fac6f714ecbae0fe

  • SHA1

    d70a7dd57e6d6063efd50e39c47c79f6b1db2a7d

  • SHA256

    b172bca2323e1f641b23c5712d44aac63c42d07cfb974e3903cd6e1a318c8947

  • SHA512

    bf54de88aeec90f55cd929f9b0b60cd15f55b9e99f373d116fe116c41f07fe9b4e252eaa8e9dae5006523e4551d0455aeaf5eb44de5d85562bc1c35eab88b7c4

  • SSDEEP

    12288:eXcmMUPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLsRf:eXiUPh2kkkkK4kXkkkkkkkkhLg

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      b172bca2323e1f641b23c5712d44aac63c42d07cfb974e3903cd6e1a318c8947

    • Size

      570KB

    • MD5

      966220b62d7f3fb2fac6f714ecbae0fe

    • SHA1

      d70a7dd57e6d6063efd50e39c47c79f6b1db2a7d

    • SHA256

      b172bca2323e1f641b23c5712d44aac63c42d07cfb974e3903cd6e1a318c8947

    • SHA512

      bf54de88aeec90f55cd929f9b0b60cd15f55b9e99f373d116fe116c41f07fe9b4e252eaa8e9dae5006523e4551d0455aeaf5eb44de5d85562bc1c35eab88b7c4

    • SSDEEP

      12288:eXcmMUPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLsRf:eXiUPh2kkkkK4kXkkkkkkkkhLg

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks