General

  • Target

    fbf2f638d91c288afc7b7beccd55cb399155bcb42c839f0917112d50a35cd2a5N

  • Size

    120KB

  • Sample

    241109-gzfxpazanh

  • MD5

    c8bedeb37792b886f2c137bb6f7c7d50

  • SHA1

    ee93a7c180c4285a668990d997cc5f64ab310abe

  • SHA256

    fbf2f638d91c288afc7b7beccd55cb399155bcb42c839f0917112d50a35cd2a5

  • SHA512

    6046ef92dbdda78bedf6c8f6f986a07bb98d49044514c58b33668318744f75f3d4490e4a95c47ea9b4dbbdce03ef6426922963ec041e240206add86101362a20

  • SSDEEP

    1536:bELbhpAdt44/wDGzWG8fPfzZoFIJ7EXWsnQUgVsZ9F4jz0cZ44mjD9r823F4:bKHwt44/QG8fP1nJ7EDmYFJi/mjRrz3C

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      fbf2f638d91c288afc7b7beccd55cb399155bcb42c839f0917112d50a35cd2a5N

    • Size

      120KB

    • MD5

      c8bedeb37792b886f2c137bb6f7c7d50

    • SHA1

      ee93a7c180c4285a668990d997cc5f64ab310abe

    • SHA256

      fbf2f638d91c288afc7b7beccd55cb399155bcb42c839f0917112d50a35cd2a5

    • SHA512

      6046ef92dbdda78bedf6c8f6f986a07bb98d49044514c58b33668318744f75f3d4490e4a95c47ea9b4dbbdce03ef6426922963ec041e240206add86101362a20

    • SSDEEP

      1536:bELbhpAdt44/wDGzWG8fPfzZoFIJ7EXWsnQUgVsZ9F4jz0cZ44mjD9r823F4:bKHwt44/QG8fP1nJ7EDmYFJi/mjRrz3C

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks