General

  • Target

    9d35810ad42fd3c7916e1a4b0a3aa9a0bcf97414b5e7dd65a350aa4c1a919564N

  • Size

    363KB

  • Sample

    241110-aq6y7awalh

  • MD5

    a30883de07939f6a0f113241ea786b70

  • SHA1

    31f836bcca880fb5f761ef56ae5f61365790c267

  • SHA256

    9d35810ad42fd3c7916e1a4b0a3aa9a0bcf97414b5e7dd65a350aa4c1a919564

  • SHA512

    868ca35b3920503e953a06a2d94cbeee7960ff908448223bc8b49e35f35732400bbb5291f28eb1f259730222e99c69684f9345f334e2ab0ef8e97e062a6f8d46

  • SSDEEP

    6144:w1t3/0h8xS/yO5VU5tTbVXksax8n5tTDUZNSN58VU5tT:w1t3/02k/y4G5tP6sus5t6NSN6G5t

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      9d35810ad42fd3c7916e1a4b0a3aa9a0bcf97414b5e7dd65a350aa4c1a919564N

    • Size

      363KB

    • MD5

      a30883de07939f6a0f113241ea786b70

    • SHA1

      31f836bcca880fb5f761ef56ae5f61365790c267

    • SHA256

      9d35810ad42fd3c7916e1a4b0a3aa9a0bcf97414b5e7dd65a350aa4c1a919564

    • SHA512

      868ca35b3920503e953a06a2d94cbeee7960ff908448223bc8b49e35f35732400bbb5291f28eb1f259730222e99c69684f9345f334e2ab0ef8e97e062a6f8d46

    • SSDEEP

      6144:w1t3/0h8xS/yO5VU5tTbVXksax8n5tTDUZNSN58VU5tT:w1t3/02k/y4G5tP6sus5t6NSN6G5t

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks