General

  • Target

    b0781dda0209e3dee49220d3b770cac0acb52893f82dc3716d8177fb41961bc8N

  • Size

    45KB

  • Sample

    241109-tpt3sawqhs

  • MD5

    df2f9bea69af60fec1fc58416b5f9fc0

  • SHA1

    e1c64ff60058ad4e68b13a3718a62440f100bfa5

  • SHA256

    b0781dda0209e3dee49220d3b770cac0acb52893f82dc3716d8177fb41961bc8

  • SHA512

    4a64d503bbd22a24209fd7266b07431b034f35d0f5c95727fd9d676b1888577e40790cd9a1d3cdbc725b81159e6b0ef36e865bfca71a5f11cea1906ebb66e889

  • SSDEEP

    768:+BI6JFjGyY2pujZVyssHDwq4v+xEgu9y5mHp//1H5S:+BfEyPUryss/4VgmyCI

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      b0781dda0209e3dee49220d3b770cac0acb52893f82dc3716d8177fb41961bc8N

    • Size

      45KB

    • MD5

      df2f9bea69af60fec1fc58416b5f9fc0

    • SHA1

      e1c64ff60058ad4e68b13a3718a62440f100bfa5

    • SHA256

      b0781dda0209e3dee49220d3b770cac0acb52893f82dc3716d8177fb41961bc8

    • SHA512

      4a64d503bbd22a24209fd7266b07431b034f35d0f5c95727fd9d676b1888577e40790cd9a1d3cdbc725b81159e6b0ef36e865bfca71a5f11cea1906ebb66e889

    • SSDEEP

      768:+BI6JFjGyY2pujZVyssHDwq4v+xEgu9y5mHp//1H5S:+BfEyPUryss/4VgmyCI

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks