General

  • Target

    7780589c092a57a68415a39b0fb5e1b64a5f94ab7bf5980bcd47c1a0c0256399N

  • Size

    97KB

  • Sample

    241110-qdks7azqgr

  • MD5

    82fc0d87ee866869c4c1e2604a6caac0

  • SHA1

    4f0c1bd527fe848ae575adef1a45b00732a8968d

  • SHA256

    7780589c092a57a68415a39b0fb5e1b64a5f94ab7bf5980bcd47c1a0c0256399

  • SHA512

    3644a5d1429bb8f38ac953be4b21b9ccb7cf529d872881db1ec6b7b1ad8d24f5f9693c2b774ad007fe83c91dcaec9d126b1d426298f5df3f312da77b9e6ec231

  • SSDEEP

    1536:ZF4un09uJbimZ7qXEwNuRRXUwXfzwE57pvJXeYZ6:xCCzsGRFPzwm7pJXeK6

Malware Config

Extracted

Family

berbew

C2

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Targets

    • Target

      7780589c092a57a68415a39b0fb5e1b64a5f94ab7bf5980bcd47c1a0c0256399N

    • Size

      97KB

    • MD5

      82fc0d87ee866869c4c1e2604a6caac0

    • SHA1

      4f0c1bd527fe848ae575adef1a45b00732a8968d

    • SHA256

      7780589c092a57a68415a39b0fb5e1b64a5f94ab7bf5980bcd47c1a0c0256399

    • SHA512

      3644a5d1429bb8f38ac953be4b21b9ccb7cf529d872881db1ec6b7b1ad8d24f5f9693c2b774ad007fe83c91dcaec9d126b1d426298f5df3f312da77b9e6ec231

    • SSDEEP

      1536:ZF4un09uJbimZ7qXEwNuRRXUwXfzwE57pvJXeYZ6:xCCzsGRFPzwm7pJXeK6

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Berbew

      Berbew is a backdoor written in C++.

    • Berbew family

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks