General

  • Target

    64b132c29f6f1b2ce713e36c74c8a6b941d8f46dd5a199caab999b210ef6a847N

  • Size

    120KB

  • Sample

    241107-f19qqawhrj

  • MD5

    a4394bbba2303bdc1e32aa5771791550

  • SHA1

    80b9358f40df027eaae619f1996db2927fb1138f

  • SHA256

    64b132c29f6f1b2ce713e36c74c8a6b941d8f46dd5a199caab999b210ef6a847

  • SHA512

    94839efb603667b6700f7a509f301ad1b47ddd5d2704f1846d6f3e91094a32345c3e5dbea4e1cefae449d16da81716496ce04b4b77c44b2001a05f2e4dfbd69f

  • SSDEEP

    3072:gwYQ1Y/V6+P7791otIcgyrVbMAgS8i/mjRrz3C:p1+VLPv91FaVYAgS8i/GC

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      64b132c29f6f1b2ce713e36c74c8a6b941d8f46dd5a199caab999b210ef6a847N

    • Size

      120KB

    • MD5

      a4394bbba2303bdc1e32aa5771791550

    • SHA1

      80b9358f40df027eaae619f1996db2927fb1138f

    • SHA256

      64b132c29f6f1b2ce713e36c74c8a6b941d8f46dd5a199caab999b210ef6a847

    • SHA512

      94839efb603667b6700f7a509f301ad1b47ddd5d2704f1846d6f3e91094a32345c3e5dbea4e1cefae449d16da81716496ce04b4b77c44b2001a05f2e4dfbd69f

    • SSDEEP

      3072:gwYQ1Y/V6+P7791otIcgyrVbMAgS8i/mjRrz3C:p1+VLPv91FaVYAgS8i/GC

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks