General

  • Target

    967265062457a00870c1da7cbe2e2bdfbe78f0140e505aaabfbe9a58fed4149eN

  • Size

    72KB

  • Sample

    241107-ev749svjfy

  • MD5

    565e40a28bbd8dc56dbc311530b344a0

  • SHA1

    eee89b8df26bc863b3612d9faf6e6ef6d471b8f5

  • SHA256

    967265062457a00870c1da7cbe2e2bdfbe78f0140e505aaabfbe9a58fed4149e

  • SHA512

    aa11c2b3d2b490aead860c75fac4c94a195c228f4cbc75bb627c2a1051cd16b8a2ada9e9d7d636c7590292eba107df45eb9445d3a8e1935a4f2355b741478b4e

  • SSDEEP

    1536:mNKzJbzjlkIrZhGLnJO59g7NPgUN3QivEtA:mKb/OMZ5oNPgU5QJA

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      967265062457a00870c1da7cbe2e2bdfbe78f0140e505aaabfbe9a58fed4149eN

    • Size

      72KB

    • MD5

      565e40a28bbd8dc56dbc311530b344a0

    • SHA1

      eee89b8df26bc863b3612d9faf6e6ef6d471b8f5

    • SHA256

      967265062457a00870c1da7cbe2e2bdfbe78f0140e505aaabfbe9a58fed4149e

    • SHA512

      aa11c2b3d2b490aead860c75fac4c94a195c228f4cbc75bb627c2a1051cd16b8a2ada9e9d7d636c7590292eba107df45eb9445d3a8e1935a4f2355b741478b4e

    • SSDEEP

      1536:mNKzJbzjlkIrZhGLnJO59g7NPgUN3QivEtA:mKb/OMZ5oNPgU5QJA

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks