General

  • Target

    933e91b19ee8e05aab5d57781136ae3acfe568ba23df0f839d20da02ea6de409N

  • Size

    90KB

  • Sample

    241110-mg2z4atrey

  • MD5

    e86acf65c4f6b4eae6f821c0b07012c0

  • SHA1

    0e92274494a1d806f2dc00ba114057f0437adb96

  • SHA256

    933e91b19ee8e05aab5d57781136ae3acfe568ba23df0f839d20da02ea6de409

  • SHA512

    bb51d56eec86aea45c702cc12b71bc2a8bade45136ab248526a9347aa466421d3d2a37bd5425daec96b0c175ec878a7a2b918b55a593d6afe2f5760135e63bf7

  • SSDEEP

    1536:rWLK/8qxQvmMKcTwPpbo7HA9vLXYVfOOQ/4BrGTI5Yxj:rL/8qxQvbhwx87HAFLUU/4kT0Yxj

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      933e91b19ee8e05aab5d57781136ae3acfe568ba23df0f839d20da02ea6de409N

    • Size

      90KB

    • MD5

      e86acf65c4f6b4eae6f821c0b07012c0

    • SHA1

      0e92274494a1d806f2dc00ba114057f0437adb96

    • SHA256

      933e91b19ee8e05aab5d57781136ae3acfe568ba23df0f839d20da02ea6de409

    • SHA512

      bb51d56eec86aea45c702cc12b71bc2a8bade45136ab248526a9347aa466421d3d2a37bd5425daec96b0c175ec878a7a2b918b55a593d6afe2f5760135e63bf7

    • SSDEEP

      1536:rWLK/8qxQvmMKcTwPpbo7HA9vLXYVfOOQ/4BrGTI5Yxj:rL/8qxQvbhwx87HAFLUU/4kT0Yxj

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks