General

  • Target

    d9860fc2ef5afe50dc2dfd25a992141fa427f5fd1bb448798a89205c3dcf6696N

  • Size

    192KB

  • Sample

    241107-fggwlavmet

  • MD5

    9f92d83f12f7fec54864899269a84a20

  • SHA1

    df12446c21e27730f95b65c1586d3d04b13c8d1c

  • SHA256

    d9860fc2ef5afe50dc2dfd25a992141fa427f5fd1bb448798a89205c3dcf6696

  • SHA512

    fde1a71e628b6e08b0cf5b666b84cbc722809cda4c6d4f83af21fd3ec13a604e274764183b9372d3d4cc6c5150149e7d1751a29d6de381302b53e502b1b250d4

  • SSDEEP

    3072:Xl9Gq+cxPzM7uYOyLy23FQo7fnEBctcp/+wreVism:VV+ILMjy23FF7fPtcsw6U1

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d9860fc2ef5afe50dc2dfd25a992141fa427f5fd1bb448798a89205c3dcf6696N

    • Size

      192KB

    • MD5

      9f92d83f12f7fec54864899269a84a20

    • SHA1

      df12446c21e27730f95b65c1586d3d04b13c8d1c

    • SHA256

      d9860fc2ef5afe50dc2dfd25a992141fa427f5fd1bb448798a89205c3dcf6696

    • SHA512

      fde1a71e628b6e08b0cf5b666b84cbc722809cda4c6d4f83af21fd3ec13a604e274764183b9372d3d4cc6c5150149e7d1751a29d6de381302b53e502b1b250d4

    • SSDEEP

      3072:Xl9Gq+cxPzM7uYOyLy23FQo7fnEBctcp/+wreVism:VV+ILMjy23FF7fPtcsw6U1

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks