General

  • Target

    7bda70308e2f53c4a34456f93b9b3afe676f926880753667b7d6e02684e15134N

  • Size

    112KB

  • Sample

    241107-ehnvvsverb

  • MD5

    ec72bfcb5ce90c13aa96195308712110

  • SHA1

    142a1e4141dc41b25192f0b40e3abb80a9b7cb8e

  • SHA256

    7bda70308e2f53c4a34456f93b9b3afe676f926880753667b7d6e02684e15134

  • SHA512

    a8bd0a00fb7344ebdbae6ea06fe5c554904e709d74546dac6caf78e2b7f787b07e7d190ef8b146e5d0704428cae5e6e1dd035c6953c4966079607bcf72746186

  • SSDEEP

    3072:jFI159qF75e0BoppUtDGOn+zdH13+EE+RaZ6r+Gd:jOv9M5e0quDzn+zd5IF6rfd

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      7bda70308e2f53c4a34456f93b9b3afe676f926880753667b7d6e02684e15134N

    • Size

      112KB

    • MD5

      ec72bfcb5ce90c13aa96195308712110

    • SHA1

      142a1e4141dc41b25192f0b40e3abb80a9b7cb8e

    • SHA256

      7bda70308e2f53c4a34456f93b9b3afe676f926880753667b7d6e02684e15134

    • SHA512

      a8bd0a00fb7344ebdbae6ea06fe5c554904e709d74546dac6caf78e2b7f787b07e7d190ef8b146e5d0704428cae5e6e1dd035c6953c4966079607bcf72746186

    • SSDEEP

      3072:jFI159qF75e0BoppUtDGOn+zdH13+EE+RaZ6r+Gd:jOv9M5e0quDzn+zd5IF6rfd

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks