General

  • Target

    cbdabf84846c35bc49290f0b4188799aad0342e6d791ef154a7ffeba38c501af

  • Size

    94KB

  • Sample

    241107-e4wslaxran

  • MD5

    ca1515288000bb5085904c27ab82ee34

  • SHA1

    76c28677af0041ffe73a3a2e96724c43e9fa5cd3

  • SHA256

    cbdabf84846c35bc49290f0b4188799aad0342e6d791ef154a7ffeba38c501af

  • SHA512

    990f3812f31ef73d30481d3325686a757c17bcd1bd653bb65c1e3f70b689d877f8931cb6666ace09ce0196e733c1d3a0d22eab15ef1984027a2b650ffee58390

  • SSDEEP

    1536:jwzEwRwsno+eF432Cvj0D0Df9Wi6gHvSlHi4Ku7BR9L4DT2EnINs:jwzEwRwsnS4mCvp9ulLKu6+ob

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      cbdabf84846c35bc49290f0b4188799aad0342e6d791ef154a7ffeba38c501af

    • Size

      94KB

    • MD5

      ca1515288000bb5085904c27ab82ee34

    • SHA1

      76c28677af0041ffe73a3a2e96724c43e9fa5cd3

    • SHA256

      cbdabf84846c35bc49290f0b4188799aad0342e6d791ef154a7ffeba38c501af

    • SHA512

      990f3812f31ef73d30481d3325686a757c17bcd1bd653bb65c1e3f70b689d877f8931cb6666ace09ce0196e733c1d3a0d22eab15ef1984027a2b650ffee58390

    • SSDEEP

      1536:jwzEwRwsno+eF432Cvj0D0Df9Wi6gHvSlHi4Ku7BR9L4DT2EnINs:jwzEwRwsnS4mCvp9ulLKu6+ob

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks