General

  • Target

    4623d30a77db482b84c2d814cdfea0392efed9fe03447217344e26d543dfff42N

  • Size

    448KB

  • Sample

    241109-klwyjazqhz

  • MD5

    91a7e345a1735c02139abed611072860

  • SHA1

    4561c74fb4aa1d0032b2e22b5591ce122bcf4f1a

  • SHA256

    4623d30a77db482b84c2d814cdfea0392efed9fe03447217344e26d543dfff42

  • SHA512

    f3d1daa8f49257ee1ab84cc1da8173689a63c41b146bb2972d10c537481ecd7876b24f9f6b92aebeaa1a9df4b2ed2bccff0f5e69939c86b783b6048568f45031

  • SSDEEP

    6144:GhxVFb6s21L7/s50z/Wa3/PNlP59ENQdgrb8X6SJqGaPonZh/nr0xuIKjyAH9SKG:4VQ705kWM/9J6gqGBf/sAHZHbgdhgi

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      4623d30a77db482b84c2d814cdfea0392efed9fe03447217344e26d543dfff42N

    • Size

      448KB

    • MD5

      91a7e345a1735c02139abed611072860

    • SHA1

      4561c74fb4aa1d0032b2e22b5591ce122bcf4f1a

    • SHA256

      4623d30a77db482b84c2d814cdfea0392efed9fe03447217344e26d543dfff42

    • SHA512

      f3d1daa8f49257ee1ab84cc1da8173689a63c41b146bb2972d10c537481ecd7876b24f9f6b92aebeaa1a9df4b2ed2bccff0f5e69939c86b783b6048568f45031

    • SSDEEP

      6144:GhxVFb6s21L7/s50z/Wa3/PNlP59ENQdgrb8X6SJqGaPonZh/nr0xuIKjyAH9SKG:4VQ705kWM/9J6gqGBf/sAHZHbgdhgi

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks