General

  • Target

    efb0829b86b5369a56e88220a0157914df0dc0592b17df15c21dec02ec88637cN

  • Size

    93KB

  • Sample

    241110-aschcsykbp

  • MD5

    55bb35c51ff8d71cbbe853107bd20c60

  • SHA1

    f44a0567bedeaee4c2cc4a4d30f8fd45cb5dcc78

  • SHA256

    efb0829b86b5369a56e88220a0157914df0dc0592b17df15c21dec02ec88637c

  • SHA512

    3b928683c00ece32c606eaf8a0d9293418cc959c48dccfeea2089f72e7c15edc2cab3d5045c5bf565c9389c398bcde92c0e6f56f4103367b12ef910927541666

  • SSDEEP

    1536:fJlFLysokjpAKWH1mjhJk4wKlO7uXcNvvm5yw/Lb0OUrrQ35wNBUyVV0:hlRysokjpaHaw97usluTXp6Uj

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      efb0829b86b5369a56e88220a0157914df0dc0592b17df15c21dec02ec88637cN

    • Size

      93KB

    • MD5

      55bb35c51ff8d71cbbe853107bd20c60

    • SHA1

      f44a0567bedeaee4c2cc4a4d30f8fd45cb5dcc78

    • SHA256

      efb0829b86b5369a56e88220a0157914df0dc0592b17df15c21dec02ec88637c

    • SHA512

      3b928683c00ece32c606eaf8a0d9293418cc959c48dccfeea2089f72e7c15edc2cab3d5045c5bf565c9389c398bcde92c0e6f56f4103367b12ef910927541666

    • SSDEEP

      1536:fJlFLysokjpAKWH1mjhJk4wKlO7uXcNvvm5yw/Lb0OUrrQ35wNBUyVV0:hlRysokjpaHaw97usluTXp6Uj

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks