General

  • Target

    8e1149baa7ba5e2a339a46666865cbf4f9b37eb44a705281c9441de3105bb885

  • Size

    324KB

  • Sample

    241110-aq91vavhjl

  • MD5

    282610b64a93a86a61a6a0c104a75b48

  • SHA1

    7819cbed0bf002f122ff8c9f9cc3b19277d19ece

  • SHA256

    8e1149baa7ba5e2a339a46666865cbf4f9b37eb44a705281c9441de3105bb885

  • SHA512

    42820747fdde65b1e327c8f03496fe9e542f590a2d58b39ef2fbe0943ec969cc8b982c6489d1c34d6b553dc4909f4b50c97944a8cf8a67d15c86ec9d845c357a

  • SSDEEP

    6144:8nAlKpzd5IF6rfBBcVPINRFYpfZvT6zAWq6JMf3us8ws:8nayp5IFy5BcVPINRFYpfZvTmAWqeMfe

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      8e1149baa7ba5e2a339a46666865cbf4f9b37eb44a705281c9441de3105bb885

    • Size

      324KB

    • MD5

      282610b64a93a86a61a6a0c104a75b48

    • SHA1

      7819cbed0bf002f122ff8c9f9cc3b19277d19ece

    • SHA256

      8e1149baa7ba5e2a339a46666865cbf4f9b37eb44a705281c9441de3105bb885

    • SHA512

      42820747fdde65b1e327c8f03496fe9e542f590a2d58b39ef2fbe0943ec969cc8b982c6489d1c34d6b553dc4909f4b50c97944a8cf8a67d15c86ec9d845c357a

    • SSDEEP

      6144:8nAlKpzd5IF6rfBBcVPINRFYpfZvT6zAWq6JMf3us8ws:8nayp5IFy5BcVPINRFYpfZvTmAWqeMfe

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks