General

  • Target

    d23cbd2d8a56bee1cc08b029c0f29bc235a925d699087fa1757ce7e51fffb41fN

  • Size

    187KB

  • Sample

    241109-kcnwkazqas

  • MD5

    a9390c34f470cc8942913a4777712710

  • SHA1

    de0449898247eb80a1bf0a819a35a93d25f417bb

  • SHA256

    d23cbd2d8a56bee1cc08b029c0f29bc235a925d699087fa1757ce7e51fffb41f

  • SHA512

    8b118490ca28b55fcd816c2489fbd98ebd3f26ecd9053135c654ec90a4ec0f25650994716d585b3befa9217219adde27d23150537f1bc0a538ee63cc292911da

  • SSDEEP

    3072:zUZBy9s22Kw3VSaida7pVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueH:zOBy9sg0i87pV+tbFOLM77OLLt

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      d23cbd2d8a56bee1cc08b029c0f29bc235a925d699087fa1757ce7e51fffb41fN

    • Size

      187KB

    • MD5

      a9390c34f470cc8942913a4777712710

    • SHA1

      de0449898247eb80a1bf0a819a35a93d25f417bb

    • SHA256

      d23cbd2d8a56bee1cc08b029c0f29bc235a925d699087fa1757ce7e51fffb41f

    • SHA512

      8b118490ca28b55fcd816c2489fbd98ebd3f26ecd9053135c654ec90a4ec0f25650994716d585b3befa9217219adde27d23150537f1bc0a538ee63cc292911da

    • SSDEEP

      3072:zUZBy9s22Kw3VSaida7pVgtRQ2c+tlB5xpWJLM77OkeCK2+hDueH:zOBy9sg0i87pV+tbFOLM77OLLt

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks