General

  • Target

    44da282e78c309a5fccc137db8169e642e71ce2760ca8fa1868f240067c86c8bN

  • Size

    92KB

  • Sample

    241107-h5425sxld1

  • MD5

    f383a1343be61229d6ec9ac56767c330

  • SHA1

    92536f31009f4e323bc6ccd8bb7d11ea277a8ad5

  • SHA256

    44da282e78c309a5fccc137db8169e642e71ce2760ca8fa1868f240067c86c8b

  • SHA512

    f99efe68cd81e6b260d58f0b77b127c045e813ca34bb44eae96b8c5129e85a73404ae891e47e9033f6540871a14d5366c12d65d20e27efa9df9a286e261674d7

  • SSDEEP

    1536:K05AnpQ/RMHX9At2Vx4IJgTVg79uznS0jnnKtO25nKQrUoR24HsUs:K05uWMHX9N/nT9uznSQnKt+6THsR

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      44da282e78c309a5fccc137db8169e642e71ce2760ca8fa1868f240067c86c8bN

    • Size

      92KB

    • MD5

      f383a1343be61229d6ec9ac56767c330

    • SHA1

      92536f31009f4e323bc6ccd8bb7d11ea277a8ad5

    • SHA256

      44da282e78c309a5fccc137db8169e642e71ce2760ca8fa1868f240067c86c8b

    • SHA512

      f99efe68cd81e6b260d58f0b77b127c045e813ca34bb44eae96b8c5129e85a73404ae891e47e9033f6540871a14d5366c12d65d20e27efa9df9a286e261674d7

    • SSDEEP

      1536:K05AnpQ/RMHX9At2Vx4IJgTVg79uznS0jnnKtO25nKQrUoR24HsUs:K05uWMHX9N/nT9uznSQnKt+6THsR

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks