General

  • Target

    bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN

  • Size

    128KB

  • Sample

    241107-hlwawsxfph

  • MD5

    7eda019aa2af4728bf89f6545ade7bd0

  • SHA1

    7d72ca7bd0fe8dd58e2649359ccafc01d48f4c44

  • SHA256

    bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7b

  • SHA512

    408e8206db896d9b72e1f9a43ae905f46c9e280678fb872563a85b7f2f730a06dacce58682f03b04f0c4abc3229462fa64e5b95ee2caf7d2da523aa0ce3bf8f8

  • SSDEEP

    3072:Q9SnqEZ7LIZmvqfTa0+bwf1nFzwSAJB8g:YSnvLIZmCfTa0b1n6xJmg

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7bN

    • Size

      128KB

    • MD5

      7eda019aa2af4728bf89f6545ade7bd0

    • SHA1

      7d72ca7bd0fe8dd58e2649359ccafc01d48f4c44

    • SHA256

      bb3842212c2ad43738b0bd579d225c8f5f4bd82d7f654c22ce06f16073920f7b

    • SHA512

      408e8206db896d9b72e1f9a43ae905f46c9e280678fb872563a85b7f2f730a06dacce58682f03b04f0c4abc3229462fa64e5b95ee2caf7d2da523aa0ce3bf8f8

    • SSDEEP

      3072:Q9SnqEZ7LIZmvqfTa0+bwf1nFzwSAJB8g:YSnvLIZmCfTa0b1n6xJmg

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks