General

  • Target

    48838cbddeecb0116c4fa49339528db829f0ea604f256606ccd32f64092a85adN

  • Size

    98KB

  • Sample

    241110-mkkj8avgme

  • MD5

    902cf93dd3d5836b57722a0aa5372bd0

  • SHA1

    4a66d6133dba7d67363d70d9e33aee3dabeb345d

  • SHA256

    48838cbddeecb0116c4fa49339528db829f0ea604f256606ccd32f64092a85ad

  • SHA512

    b40aff1e6a325a2b2dee9da6735a6667e5b44f19ada70e2e751c4a487b3ab754d589395bd259709a81664ec0958a59488fcc9d2cbf2eb4d7b410423b7bc4c91d

  • SSDEEP

    3072:u3OULdicq0bBbYLb2rI+/HBGBTJAEZeFKPD375lHzpa1P:u3tdicBNbO2rj/HBcJAEZeYr75lHzpaF

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      48838cbddeecb0116c4fa49339528db829f0ea604f256606ccd32f64092a85adN

    • Size

      98KB

    • MD5

      902cf93dd3d5836b57722a0aa5372bd0

    • SHA1

      4a66d6133dba7d67363d70d9e33aee3dabeb345d

    • SHA256

      48838cbddeecb0116c4fa49339528db829f0ea604f256606ccd32f64092a85ad

    • SHA512

      b40aff1e6a325a2b2dee9da6735a6667e5b44f19ada70e2e751c4a487b3ab754d589395bd259709a81664ec0958a59488fcc9d2cbf2eb4d7b410423b7bc4c91d

    • SSDEEP

      3072:u3OULdicq0bBbYLb2rI+/HBGBTJAEZeFKPD375lHzpa1P:u3tdicBNbO2rj/HBcJAEZeYr75lHzpaF

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks