General

  • Target

    113e0d8d55c78afa85c9d5b6cb9b01b80bad19520f0e288d3b0e365d5a82c196N

  • Size

    72KB

  • Sample

    241109-p1qghsvclr

  • MD5

    e21dcdf9efa2bd990e478de7a87c4880

  • SHA1

    28f6f7c3090fc3733fac9bb6fc222f8b2d845798

  • SHA256

    113e0d8d55c78afa85c9d5b6cb9b01b80bad19520f0e288d3b0e365d5a82c196

  • SHA512

    ede75cf578c27d0a152218de9727be4feddfa8333ccdb5c09d19f7848fd3eb39b264c86231f081b7b0c5edd1579db27f16b127a354a43e62858419af9e8dfe45

  • SSDEEP

    1536:RkL4zj88ga25q/GE5sA0+pddA2PgUN3QivEtA:Rkaviv0dA2PgU5QJA

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      113e0d8d55c78afa85c9d5b6cb9b01b80bad19520f0e288d3b0e365d5a82c196N

    • Size

      72KB

    • MD5

      e21dcdf9efa2bd990e478de7a87c4880

    • SHA1

      28f6f7c3090fc3733fac9bb6fc222f8b2d845798

    • SHA256

      113e0d8d55c78afa85c9d5b6cb9b01b80bad19520f0e288d3b0e365d5a82c196

    • SHA512

      ede75cf578c27d0a152218de9727be4feddfa8333ccdb5c09d19f7848fd3eb39b264c86231f081b7b0c5edd1579db27f16b127a354a43e62858419af9e8dfe45

    • SSDEEP

      1536:RkL4zj88ga25q/GE5sA0+pddA2PgUN3QivEtA:Rkaviv0dA2PgU5QJA

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks