General

  • Target

    5a684b8f74635f9a1f89b9b46d54f0e7aeb3c2960d8a66da6ea1fa402ae5893bN

  • Size

    90KB

  • Sample

    241109-f3dfasydmr

  • MD5

    b099a13e8d2a1af7ebb6848d6fcf78f0

  • SHA1

    791c6d78c6a727ab85a0c969f1ffa658b1c32ff3

  • SHA256

    5a684b8f74635f9a1f89b9b46d54f0e7aeb3c2960d8a66da6ea1fa402ae5893b

  • SHA512

    e3aeacecac05cb08533be0807afbafa413030a7807ac520c6d2aaf5a250ebd2289d8fc931e3c12bfded654ecaf132603e769c18f9a11ceeb6eaf5076879fd7dc

  • SSDEEP

    1536:MUKFCI8eCRiTYtFWwPxLCiunQ2oDjlhNGCu/Ub0VkVNK:MC1CydxCiuQ2oRGCu/Ub0+NK

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      5a684b8f74635f9a1f89b9b46d54f0e7aeb3c2960d8a66da6ea1fa402ae5893bN

    • Size

      90KB

    • MD5

      b099a13e8d2a1af7ebb6848d6fcf78f0

    • SHA1

      791c6d78c6a727ab85a0c969f1ffa658b1c32ff3

    • SHA256

      5a684b8f74635f9a1f89b9b46d54f0e7aeb3c2960d8a66da6ea1fa402ae5893b

    • SHA512

      e3aeacecac05cb08533be0807afbafa413030a7807ac520c6d2aaf5a250ebd2289d8fc931e3c12bfded654ecaf132603e769c18f9a11ceeb6eaf5076879fd7dc

    • SSDEEP

      1536:MUKFCI8eCRiTYtFWwPxLCiunQ2oDjlhNGCu/Ub0VkVNK:MC1CydxCiuQ2oRGCu/Ub0+NK

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks