General

  • Target

    93105ae5480956f3f6dfc712bd4fdf7d85872476569069709cb68c5334044dceN

  • Size

    74KB

  • Sample

    241109-tcjraaxdrh

  • MD5

    19c7a3eca54e80078e409ab0547340d0

  • SHA1

    8ae7aeede100c1000d09cd8b910f97656f25481b

  • SHA256

    93105ae5480956f3f6dfc712bd4fdf7d85872476569069709cb68c5334044dce

  • SHA512

    f728037546196b38f9f73ae0de1eb3e6c3d284fd865f2fd08ece7efaa409427aee361d8363ea765c4a9d3fe919f8fa86625d70f27eacc1b4681e27550b4cfecf

  • SSDEEP

    1536:DWquI11SeqRbKN50b3/qUEOEeITnxrnf+:DWquI+egmN50jP/9IThf+

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      93105ae5480956f3f6dfc712bd4fdf7d85872476569069709cb68c5334044dceN

    • Size

      74KB

    • MD5

      19c7a3eca54e80078e409ab0547340d0

    • SHA1

      8ae7aeede100c1000d09cd8b910f97656f25481b

    • SHA256

      93105ae5480956f3f6dfc712bd4fdf7d85872476569069709cb68c5334044dce

    • SHA512

      f728037546196b38f9f73ae0de1eb3e6c3d284fd865f2fd08ece7efaa409427aee361d8363ea765c4a9d3fe919f8fa86625d70f27eacc1b4681e27550b4cfecf

    • SSDEEP

      1536:DWquI11SeqRbKN50b3/qUEOEeITnxrnf+:DWquI+egmN50jP/9IThf+

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks