General

  • Target

    2cc1bc36fdd3005b45416c0bb8fb09c9a3ae520cbbebd50e136681105b7ceef5N

  • Size

    96KB

  • Sample

    241110-njmtmaypbk

  • MD5

    4fa27efe0762f3f7904fab5c83ced9a0

  • SHA1

    1c334ae441ca10e9843647a8a25c49c5f97ddb60

  • SHA256

    2cc1bc36fdd3005b45416c0bb8fb09c9a3ae520cbbebd50e136681105b7ceef5

  • SHA512

    c93a9dce3c8c12ea16b8a2e6c58b382ad76e30459493779b3e2c45af2ef677a659cd639cebe51e5a4bf4630ce7e1ced47aa659d09cede5be18c427b9121288c2

  • SSDEEP

    1536:+YSEZYwUYRJ0IA0B9YTL0rFFqiRYAB13SKRQ+7R5R45WtqV9R2R462izMg3R7ih9:/p9Jf90GEi+A2Ke+7HrtG9MW3+3l29

Malware Config

Extracted

Family

berbew

C2

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      2cc1bc36fdd3005b45416c0bb8fb09c9a3ae520cbbebd50e136681105b7ceef5N

    • Size

      96KB

    • MD5

      4fa27efe0762f3f7904fab5c83ced9a0

    • SHA1

      1c334ae441ca10e9843647a8a25c49c5f97ddb60

    • SHA256

      2cc1bc36fdd3005b45416c0bb8fb09c9a3ae520cbbebd50e136681105b7ceef5

    • SHA512

      c93a9dce3c8c12ea16b8a2e6c58b382ad76e30459493779b3e2c45af2ef677a659cd639cebe51e5a4bf4630ce7e1ced47aa659d09cede5be18c427b9121288c2

    • SSDEEP

      1536:+YSEZYwUYRJ0IA0B9YTL0rFFqiRYAB13SKRQ+7R5R45WtqV9R2R462izMg3R7ih9:/p9Jf90GEi+A2Ke+7HrtG9MW3+3l29

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks