General

  • Target

    89ba75f2ef05171790e7302e9298829e111c0092b4e99e1bec21a1111a8aefbdN

  • Size

    570KB

  • Sample

    241107-jk984axnes

  • MD5

    a4313fb209bd3916b6491b331614ed60

  • SHA1

    7dc331a4ab1cd028228654785b00a66db8d9fce5

  • SHA256

    89ba75f2ef05171790e7302e9298829e111c0092b4e99e1bec21a1111a8aefbd

  • SHA512

    1a1923f8a4dc84ce09be7c5f1e2e6a9c9b27348c078538fd0e6940b7743ea00cfb5ce510dd2a55afe86595ec98165f1e8dfe817a9e8851ee0f332cca30b9fbaa

  • SSDEEP

    12288:i3Gn3Ph2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLsRf:i3s3Ph2kkkkK4kXkkkkkkkkhLg

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      89ba75f2ef05171790e7302e9298829e111c0092b4e99e1bec21a1111a8aefbdN

    • Size

      570KB

    • MD5

      a4313fb209bd3916b6491b331614ed60

    • SHA1

      7dc331a4ab1cd028228654785b00a66db8d9fce5

    • SHA256

      89ba75f2ef05171790e7302e9298829e111c0092b4e99e1bec21a1111a8aefbd

    • SHA512

      1a1923f8a4dc84ce09be7c5f1e2e6a9c9b27348c078538fd0e6940b7743ea00cfb5ce510dd2a55afe86595ec98165f1e8dfe817a9e8851ee0f332cca30b9fbaa

    • SSDEEP

      12288:i3Gn3Ph2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLsRf:i3s3Ph2kkkkK4kXkkkkkkkkhLg

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks