General

  • Target

    4dbe55c5c7616a490c29eb46316b1e09bcc264f7d0fc7fb713b4cbdceb5009a9N

  • Size

    91KB

  • Sample

    241107-j688xsyhkp

  • MD5

    e6f4a13097f18818d44ae26044963490

  • SHA1

    4d351dae72e682e7f785c79d63ae544cafdf3510

  • SHA256

    4dbe55c5c7616a490c29eb46316b1e09bcc264f7d0fc7fb713b4cbdceb5009a9

  • SHA512

    a385374c1d2b61b7de457886c1e035c307b3c98d1dc08e3e8ec9d9378ddc3a46dc93cb3df85ed214745aa960e7d6debc8ae7530dd40f4b715c6deefcf389b5c2

  • SSDEEP

    1536:wymETlMpbQi9VECrdmDriC3FSr7TiwkU6joqqIVLg+:bapbr9VECrdkvFSr7TSUurU+

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      4dbe55c5c7616a490c29eb46316b1e09bcc264f7d0fc7fb713b4cbdceb5009a9N

    • Size

      91KB

    • MD5

      e6f4a13097f18818d44ae26044963490

    • SHA1

      4d351dae72e682e7f785c79d63ae544cafdf3510

    • SHA256

      4dbe55c5c7616a490c29eb46316b1e09bcc264f7d0fc7fb713b4cbdceb5009a9

    • SHA512

      a385374c1d2b61b7de457886c1e035c307b3c98d1dc08e3e8ec9d9378ddc3a46dc93cb3df85ed214745aa960e7d6debc8ae7530dd40f4b715c6deefcf389b5c2

    • SSDEEP

      1536:wymETlMpbQi9VECrdmDriC3FSr7TiwkU6joqqIVLg+:bapbr9VECrdkvFSr7TSUurU+

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks