General

  • Target

    c0f89cc48a3b21567ea59383d637f39c0e347a08ab84cf3d5455d8bbca1cf908

  • Size

    97KB

  • Sample

    241107-eked7sxmgn

  • MD5

    652f49eff95942c6c47ad1715f2489e7

  • SHA1

    babdfcf104cb736e3dec91e05908506d71e88645

  • SHA256

    c0f89cc48a3b21567ea59383d637f39c0e347a08ab84cf3d5455d8bbca1cf908

  • SHA512

    054494168ff282967127e762d78829c357e335cbc63cbb20c5b526a6e94a039cb68558fde3be01a6d59104d88798c5888f20bfcb9469eda0be4eec4fc3016205

  • SSDEEP

    1536:VjlsC9J7CwokLrTkCPReTXUwXfzwE57pvJXeYZ6:VjmKJ+YBpwPzwm7pJXeK6

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      c0f89cc48a3b21567ea59383d637f39c0e347a08ab84cf3d5455d8bbca1cf908

    • Size

      97KB

    • MD5

      652f49eff95942c6c47ad1715f2489e7

    • SHA1

      babdfcf104cb736e3dec91e05908506d71e88645

    • SHA256

      c0f89cc48a3b21567ea59383d637f39c0e347a08ab84cf3d5455d8bbca1cf908

    • SHA512

      054494168ff282967127e762d78829c357e335cbc63cbb20c5b526a6e94a039cb68558fde3be01a6d59104d88798c5888f20bfcb9469eda0be4eec4fc3016205

    • SSDEEP

      1536:VjlsC9J7CwokLrTkCPReTXUwXfzwE57pvJXeYZ6:VjmKJ+YBpwPzwm7pJXeK6

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks