General

  • Target

    863a0f31f75b1fdf1c1336b254b6db4be471288d33542b95e81093c83e5b2080N

  • Size

    121KB

  • Sample

    241107-ezzzfsxqdp

  • MD5

    7ca146fba00cdf6d582accedf4106f60

  • SHA1

    6c6b275935139eeeb20d95ef40ff313a7502a81f

  • SHA256

    863a0f31f75b1fdf1c1336b254b6db4be471288d33542b95e81093c83e5b2080

  • SHA512

    9daba45e3dd5e6ee07391355435de849a3c75c6aaf6ed36becedd3d2190c8571c20890e6c034f9f26e6bb2792e01e1182a98a9559604b535538f447a1be8ae0b

  • SSDEEP

    1536:cy8lg7ALe0FCyEV9CnDyB58RY3PpR0q8sWDK08M3r1JiNrvVycxT8EibNWT7boCB:b7ibI1BtwDKKmrvz6bUTX1O7AJnD5tvv

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      863a0f31f75b1fdf1c1336b254b6db4be471288d33542b95e81093c83e5b2080N

    • Size

      121KB

    • MD5

      7ca146fba00cdf6d582accedf4106f60

    • SHA1

      6c6b275935139eeeb20d95ef40ff313a7502a81f

    • SHA256

      863a0f31f75b1fdf1c1336b254b6db4be471288d33542b95e81093c83e5b2080

    • SHA512

      9daba45e3dd5e6ee07391355435de849a3c75c6aaf6ed36becedd3d2190c8571c20890e6c034f9f26e6bb2792e01e1182a98a9559604b535538f447a1be8ae0b

    • SSDEEP

      1536:cy8lg7ALe0FCyEV9CnDyB58RY3PpR0q8sWDK08M3r1JiNrvVycxT8EibNWT7boCB:b7ibI1BtwDKKmrvz6bUTX1O7AJnD5tvv

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks