General

  • Target

    51c8795c032a342a40754a527dfe73218dc1c79db3a6d7943c507e3bd024ca0cN

  • Size

    55KB

  • Sample

    241110-cghw4sxcpf

  • MD5

    f2f6d8890b2604ddcd7d52e3a3da3910

  • SHA1

    66e6960cd1b9594239eea43e1ba828e2c784af01

  • SHA256

    51c8795c032a342a40754a527dfe73218dc1c79db3a6d7943c507e3bd024ca0c

  • SHA512

    afbb54047af44e7da4c1a946e6d916931dc48ef79498149277efa7915a17bb1906c37593cf353c2bd7ffc1e96d399415f55e00f256e19f2b91c36d8273e4dd3e

  • SSDEEP

    1536:ytIGmjgJvXFrjIYnIKSLh7bI8CNSoNSd0A3shxD6:MFvLSLh708CNXNW0A8hh

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      51c8795c032a342a40754a527dfe73218dc1c79db3a6d7943c507e3bd024ca0cN

    • Size

      55KB

    • MD5

      f2f6d8890b2604ddcd7d52e3a3da3910

    • SHA1

      66e6960cd1b9594239eea43e1ba828e2c784af01

    • SHA256

      51c8795c032a342a40754a527dfe73218dc1c79db3a6d7943c507e3bd024ca0c

    • SHA512

      afbb54047af44e7da4c1a946e6d916931dc48ef79498149277efa7915a17bb1906c37593cf353c2bd7ffc1e96d399415f55e00f256e19f2b91c36d8273e4dd3e

    • SSDEEP

      1536:ytIGmjgJvXFrjIYnIKSLh7bI8CNSoNSd0A3shxD6:MFvLSLh708CNXNW0A8hh

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks