General

  • Target

    bf8befcc829d2b95f6596d6ac7618d96e77c555e48d6dec0cc5574d727dee7f1

  • Size

    512KB

  • Sample

    241107-eg85eaxmdk

  • MD5

    9278bb6611427eda67fd4a8490594fb0

  • SHA1

    03469989fef7f5dd503022b3c0683451d4bc69dd

  • SHA256

    bf8befcc829d2b95f6596d6ac7618d96e77c555e48d6dec0cc5574d727dee7f1

  • SHA512

    39a4e0b8cdf7a36691f81001b9b55d75110300d6a2ecd24a2b6e66cbec0109969d542af11215350cc32afc3a98f0c4e0826d7c54bdbd94453b1e22d7183ef70a

  • SSDEEP

    12288:dQ68e+FGyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSg9:a68eKGyXsGG1ws5ipr

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bf8befcc829d2b95f6596d6ac7618d96e77c555e48d6dec0cc5574d727dee7f1

    • Size

      512KB

    • MD5

      9278bb6611427eda67fd4a8490594fb0

    • SHA1

      03469989fef7f5dd503022b3c0683451d4bc69dd

    • SHA256

      bf8befcc829d2b95f6596d6ac7618d96e77c555e48d6dec0cc5574d727dee7f1

    • SHA512

      39a4e0b8cdf7a36691f81001b9b55d75110300d6a2ecd24a2b6e66cbec0109969d542af11215350cc32afc3a98f0c4e0826d7c54bdbd94453b1e22d7183ef70a

    • SSDEEP

      12288:dQ68e+FGyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSg9:a68eKGyXsGG1ws5ipr

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks