General

  • Target

    03abfb051cdb46691f5fa9e4ff543680306841b9892b601696969a07dd161b7fN

  • Size

    1000KB

  • Sample

    241107-egq9latqbv

  • MD5

    f4d00ee62e389facc69ca05d33ab95e0

  • SHA1

    27aadea1bf6fb87e22a20b01e3203e9591d6ceb3

  • SHA256

    03abfb051cdb46691f5fa9e4ff543680306841b9892b601696969a07dd161b7f

  • SHA512

    2449ea647bd9184baf6b0e347c0eb6d77bad988d439f247f53c8678bf8e8df833d325a1b0477c825ff2d5f1acc1f038d924ee96497f8503adb13c6635b4a3c6b

  • SSDEEP

    6144:xKwdmIhQE9RqxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCh:xWPZtHBFLPj3TmLnWrOxNuxC97hFq9o7

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      03abfb051cdb46691f5fa9e4ff543680306841b9892b601696969a07dd161b7fN

    • Size

      1000KB

    • MD5

      f4d00ee62e389facc69ca05d33ab95e0

    • SHA1

      27aadea1bf6fb87e22a20b01e3203e9591d6ceb3

    • SHA256

      03abfb051cdb46691f5fa9e4ff543680306841b9892b601696969a07dd161b7f

    • SHA512

      2449ea647bd9184baf6b0e347c0eb6d77bad988d439f247f53c8678bf8e8df833d325a1b0477c825ff2d5f1acc1f038d924ee96497f8503adb13c6635b4a3c6b

    • SSDEEP

      6144:xKwdmIhQE9RqxDHBFLqWjjgwTgZLnSnLrTSxJ2JrYXklSu9lIhBBJKQh31GTYUCh:xWPZtHBFLPj3TmLnWrOxNuxC97hFq9o7

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks