General

  • Target

    f32974227bda0c6388d47533aef22eaa60d75d4df36a3f10ab4154b3b02cf509N

  • Size

    669KB

  • Sample

    241109-p273ysvcpq

  • MD5

    aa2dcffc742e06884d6e0fbe6cf324a0

  • SHA1

    fea5d8d5fc42345f84a54da08ebb60cf2cf7a196

  • SHA256

    f32974227bda0c6388d47533aef22eaa60d75d4df36a3f10ab4154b3b02cf509

  • SHA512

    1dfa76fd68116a4efd85fa3e51a699d6f531c0420828dac58eb0948523693c6df953b85acd7e0b1d2425eea407559f20e3c517f562fd75e8fff770a930ee7617

  • SSDEEP

    12288:6KSCBi6eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:LLIFchMpQnqrdX72LbY6x46uR/qYglMi

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      f32974227bda0c6388d47533aef22eaa60d75d4df36a3f10ab4154b3b02cf509N

    • Size

      669KB

    • MD5

      aa2dcffc742e06884d6e0fbe6cf324a0

    • SHA1

      fea5d8d5fc42345f84a54da08ebb60cf2cf7a196

    • SHA256

      f32974227bda0c6388d47533aef22eaa60d75d4df36a3f10ab4154b3b02cf509

    • SHA512

      1dfa76fd68116a4efd85fa3e51a699d6f531c0420828dac58eb0948523693c6df953b85acd7e0b1d2425eea407559f20e3c517f562fd75e8fff770a930ee7617

    • SSDEEP

      12288:6KSCBi6eVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:LLIFchMpQnqrdX72LbY6x46uR/qYglMi

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks